bugGNU roff - Bugs: bug #55331, ...

 
 

bug #55331: src/utils/hpftodit/hpftodit.cpp:577:Wmismatched-new-delete

Submitter:  David Binderman <dcb314>
Submitted:  Sun 30 Dec 2018 10:59:41 AM UTC
   
 
Category:  Font - others/general Severity:  4 - Important
Item Group:  Incorrect behaviour Status:  Fixed
Privacy:  Public Assigned to:  bgarrigues
Open/Closed:  Closed Planned Release:  1.23.0
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 02 May 2022 01:16:04 AM UTC, comment #3: 


commit 0d4df60290dc22e3975c803833219cd853b0827e
Author: Bertrand Garrigues <bertrand.garrigues@laposte.net>
Date:   Sun Oct 18 01:44:24 2020 +0200

    hpftodit: incorrect 'delete' after new[]

    * src/utils/hpftodit/hpftodit.cpp (output_font_name): use 'delete[]'.

    Fixes bug #55331. Found by David Binderman, fixed by Ingo Schwarze.


G. Branden Robinson <gbranden>
Group administrator
Sat 17 Oct 2020 11:55:41 PM UTC, comment #2: 

I've never used 'hpftodit' either; I managed to test as follows: 'font/devlj4/generate/Makefile' instructs to do:

  cd font/devlj4/
  make -f generate/Makefile

to re-generate the fonts.  This is broken has it expects tfm files to be installed in /usr/local/lib/groff-lj4.  So I've downloaded 'ftp://ftp.hp.com/pub/faxes/software/tfmlj4p.exe' mentioned in the same Makefile, extracted the tfmlj4p.exe with unzip, copied a tfm file (9NB00086.TFM) in font/devlj4 and then done this:

   hpftodit 9NB00086.TFM generate/text.map TR

If I launch this command with valgrind, the following error is detected:

==12026== Mismatched free() / delete / delete []
==12026==    at 0x483C08B: operator delete(void*, unsigned long) (vg_replace_malloc.c:593)
==12026==    by 0x12AF35: output_font_name (hpftodit.cpp:577)
==12026==    by 0x12AF35: main (hpftodit.cpp:362)
==12026==  Address 0x4ea6d10 is 0 bytes inside a block of size 17 alloc'd
==12026==    at 0x483B50F: operator new[](unsigned long) (vg_replace_malloc.c:431)
==12026==    by 0x12AE60: output_font_name (hpftodit.cpp:558)
==12026==    by 0x12AE60: main (hpftodit.cpp:362)
==12026==

After I've applied the fix, this error no longer appears. The generated file is also indentical.  This is sufficient, I think, push the commit (commited on 0d4df60290dc22e3975c803833219cd853b0827e).



Bertrand Garrigues <bgarrigues>
Group administrator
Mon 31 Dec 2018 01:59:02 PM UTC, comment #1: 

Bug confirmed by code inspection.  Both lines quoted by David are in the function output_font_name(), and the code progresses linearily and unconditionally from the "new[]" to the "delete", without any branching in or out in between, so every invocation of the new[] is 100% certain to trigger the bug at run time.

According to Stroustrup, mismatches of this kind can trigger compiler-implementation-dependent undefined behaviour.  So this should be treated as a severe and potentially dangerous bug, similar to a buffer overflow or double free, with potential for incorrect and insecure behaviour and crashes.

So i'm setting the item group to "incorrect behaviour", the severity to "important", and the "planned release" to 1.22.5.

The obvious fix is

-  delete font_name;
+  delete[] font_name;

Unfortunately, i never used hpftodit(1) and don't even understand its purpose, so i cannot test and hence won't commit.  But if somebody else can test, you have my OK for that fix.

Ingo Schwarze <schwarze>
Group Member
Sun 30 Dec 2018 10:59:41 AM UTC, original submission:  

src/utils/hpftodit/hpftodit.cpp:577:3: warning: 'delete' applied to a pointer that was allocated with 'new[]'; did you mean 'delete[]'? [-Wmismatched-new-delete]

$ fgrep font_name src/utils/hpftodit/hpftodit.cpp
  char *font_name = new char[count];
 
  delete font_name;
$

David Binderman <dcb314>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gbranden (Updated the item)
  • -email is unavailable- added by bgarrigues (Posted a comment)
  • -email is unavailable- added by schwarze (Posted a comment)
  • -email is unavailable- added by dcb314 (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 9 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-10-07 gbranden CategoryDriver - others/general Font - others/general
    2022-05-02 gbranden CategoryNone Driver - others/general
    2021-04-27 gbranden Assigned toNone bgarrigues
    2020-10-17 bgarrigues StatusConfirmed Fixed
        Open/ClosedOpen Closed
    2018-12-31 schwarze Severity3 - Normal 4 - Important
        Item GroupNone Incorrect behaviour
        StatusNone Confirmed
        Planned ReleaseNone 1.23.0

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code