bugGNU roff - Bugs: bug #61144, [refer] bad validation of list in...

 
 

bug #61144: [refer] bad validation of list in indexed biblography file

Submitter:  G. Branden Robinson <gbranden>
Submitted:  Sat 11 Sep 2021 05:33:16 PM UTC
   
 
Category:  Preprocessor refer Severity:  2 - Minor
Item Group:  Incorrect behaviour Status:  Fixed
Privacy:  Public Assigned to:  gbranden
Open/Closed:  Closed Planned Release:  1.23.0
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 11 Sep 2021 08:29:33 PM UTC, comment #1: 


commit 3f94abf4072e46f1f2e434a0b3582961113991af
Author: G. Branden Robinson <g.branden.robinson@gmail.com>
Date:   Sun Sep 12 05:30:07 2021 +1000

    [libbib]: Stop throwing spurious diagnostic.

    * src/libs/libbib/index.cpp (index_search_item::get_invalidity_reason):
      Don't complain about about a last list element being nonnegative if
      the list size was zero in the first place, as can happen with an empty
      index.  More seriously from a language standpoint, avoid reading
      through a negative array index (this can escape a compiler's attention
      because we're reading from the midst of a heap-allocated or `mmap()`ed
      region, but it's still a code smell).

    Fixes <https://savannah.gnu.org/bugs/?61144>.


G. Branden Robinson <gbranden>
Group administrator
Sat 11 Sep 2021 05:33:16 PM UTC, original submission:  

In groff 1.22.4, and probably every version going back to June 1991 at the latest, we can observe a misleading diagnostic when performing validation using the (undocumented) refer(1) `-V` option with an empty indexed bibliography.

To create an empty indexed bibliography, create an empty file and index it with indxbib(1).

Then use that bibliography as the database for preprocessing a document.

In both cases we will use the same input document and (empty, indexed) bibliography.  Note how a misleading error diagnostic is produced when -V is used.


$ > empty
$ indxbib empty # creates `empty.i`
$ cat > doc.roff
foo
.[
a
.]
$ REFER=empty refer doc.roff
.lf 1 doc.roff
refer:doc.roff:4: warning: all keys would have been discarded in constructing index 'empty.i'
refer:doc.roff:4: no matches for 'a'
foo\*([.1\*(.]
.ds [F 1
.]-
.][ 0 other
$ REFER=empty refer -V doc.roff
.lf 1 doc.roff
refer:doc.roff:4: 'empty.i' is bad: last list element not negative
refer:doc.roff:4: no matches for 'a'
foo\*([.1\*(.]
.ds [F 1
.]-
.][ 0 other


The problem is not that the last list element was not negative, but rather that the list length was zero, so some data is read and misinterpreted.

I ran into this issue while studying a more serious problem with indexed bibliographic database processing, wherein we fall prey to the the classic problem of believing what a data file tells you about the sizes of the data structures you should allocate[1], leading to a heap overread and segmentation fault.

The problem is actually in src/libs/libbib/index.cpp:index_search_item::verify.

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=716109


G. Branden Robinson <gbranden>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gbranden (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-09-11 gbranden StatusIn Progress Fixed
        Open/ClosedOpen Closed
        Planned ReleaseNone 1.23.0

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code