bugGNU roff - Bugs: bug #64301, [troff] susceptible to integer...


bug #64301: [troff] susceptible to integer overflow when built with -ftrapv

Submitter:  G. Branden Robinson <gbranden>
Submitted:  Tue 13 Jun 2023 09:52:33 PM UTC
Category:  Core Severity:  4 - Important
Item Group:  Crash/Unresponsive Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup

Tue 13 Jun 2023 09:52:33 PM UTC, original submission:  

If you build GNU troff with `-ftrapv`, you can construct input that will cause a core dump.

Apply this patch to tmac/pdf.tmac:

diff --git a/tmac/pdf.tmac b/tmac/pdf.tmac
index 6a2fa7bba..fdf1da7af 100644
--- a/tmac/pdf.tmac
+++ b/tmac/pdf.tmac
@@ -36,7 +36,13 @@ am solely responsible for any bugs I may have introduced into this file.
 .mso ps.tmac
 .de pdf:SS
-.      fchar \\$1 \\S'16'\\$1\\S'0'
+.  ps
+.  nr pdf:prevps \\n[.ps]
+.  ps
+.  nr pdf:ps \\n[.ps]
+.  fchar \\$1 \s'\\n[pdf:ps]u*89u/100u'\S'16'\\$1\S'0'\s'\\n[pdf:prevps]u'
+.  ps \\n[pdf:prevps]
+.  ps \\n[pdf:ps]
 .pdf:SS \[+h]
 .pdf:SS \[ts]

(The above may have an error; that's not the point.)

$ cat EXPERIMENTS/oversized-greek.roff
f ( pi ) + 2 pi int sin ( omega t ) dt + e sup { i pi sup { rho + 1 } }
$ ./build/test-groff -e -Tpdf -z EXPERIMENTS/oversized-greek.roff
troff:.../../tmac/pdf.tmac:74: error: numeric overflow
troff: backtrace: '.../build/../tmac/pdf.tmac':45: macro 'pdf:SS'
troff: backtrace: file '.../build/../tmac/pdf.tmac':74
troff: backtrace: file '.../build/../tmac/troffrc':33
troff:.../build/../tmac/pdf.tmac:74: error: numeric overflow
.../build/groff: error: troff: Illegal instruction (core dumped)
[running gdb]
Core was generated by `troff -b -ww -Tpdf'.
Program terminated with signal SIGILL, Illegal instruction.
#0  0x0000562d89c7114e in get_number (res=res@entry=0x7fffd477c434, si=si@entry=122 'z', prev_value=<optimized out>)
    at ../src/roff/troff/number.cpp:165
165         *res = prev_value + v;
##(gdb) list
160         return 0;
161       case ABSOLUTE:
162         *res = v;
163         break;
164       case INCREMENT:
165         *res = prev_value + v;
166         break;
167       case DECREMENT:
168         *res = prev_value - v;
169         break;


G. Branden Robinson <gbranden>
Group administrator


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

   bug dependencies.


Carbon-Copy List
  • -email is unavailable- added by gbranden (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.


    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2023-08-10 gbranden Dependencies- bugs #63587 is dependent
    2023-06-22 gbranden Summarysusceptible to integer overflow when built with -ftrapv [troff] susceptible to integer overflow when built with -ftrapv

    Back to the top

    Powered by Savane 3.13-9c15.
    Corresponding source code