bugGNU roff - Bugs: bug #56555, [libdriver] I can make grops and...

 
 

bug #56555: [libdriver] I can make grops and grotty core dump with 5 bytes of input

Submitter:  G. Branden Robinson <gbranden>
Submitted:  Wed 26 Jun 2019 03:51:56 PM UTC
   
 
Category:  Driver - others/general Severity:  3 - Normal
Item Group:  Crash/Unresponsive Status:  Fixed
Privacy:  Public Assigned to:  gbranden
Open/Closed:  Closed Planned Release:  1.23.0
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Wed 26 Jun 2019 07:11:24 PM UTC, comment #7: 

Thanks, Werner!

G. Branden Robinson <gbranden>
Group administrator
Wed 26 Jun 2019 06:07:12 PM UTC, comment #6: 

Your patch looks good, thanks!

Werner LEMBERG <wl>
Group administrator
Wed 26 Jun 2019 05:46:51 PM UTC, comment #5: 

To clarify my earlier comment about "malformed input", there was nothing wrong with the syntax of the ditroff t command in the input file.

roff veterans know this, but a ditroff file requires some prologue (and epilogue) to be well-formed.

My crasher document consisted solely of the characters "\!tr" (and a newline), which used the "transparent line indicator" to pass the contents of the line after the \! escape directly to groff's intermediate output format (which is a pain to type out so I just say "ditroff").

"tr" means "typeset the letter r".

If we ask the groff frontend to typeset the letter "r", we get much more:


$ echo r | groff -Z
x T ps
x res 72000 1 1
x init
p1
x font 5 TR
f5
s10000
V12000
H72000
md
DFd
tr
n12000 0
x trailer
V792000
x stop


Careful inspection reveals a line exactly matching "tr".

One might be surprised to learn that the output for the supposedly-simpler nroff/grotty devices is not any simpler.

G. Branden Robinson <gbranden>
Group administrator
Wed 26 Jun 2019 05:29:21 PM UTC, comment #4: 

This seems to be a bog-standard instance of calling functions that can return errors and then not checking for errors.

A fix is attached.  Please code-review.

Although the problem is in libdriver, I went ahead and tested the fix on every output driver that calls set_char(), and got satisfactory results (complaint, but no crash):


$ grep -lrw 'set_char' src
src/include/printer.h
src/libs/libdriver/printer.cpp
src/devices/grolj4/lj4.cpp
src/devices/grotty/tty.cpp
src/devices/grolbp/lbp.cpp
src/devices/grohtml/post-html.cpp
src/devices/grodvi/dvi.cpp
src/devices/grops/ps.cpp

$ for DEV in lj4 utf8 ascii lbp html dvi ps; do ./build/test-groff -T$DEV ./crash.nroff >/dev/null || echo driver $DEV failed with exit status $?; done
grolj4:<standard input>:5: bad font position '-1'
grotty:<standard input>:5: bad font position '-1'
grotty:<standard input>:5: bad font position '-1'
grolbp:<standard input>:5: bad font position '-1'
grops:<standard input> (././crash.nroff):6: bad font position '-1'
post-grohtml:<standard input> (././crash.nroff):26: bad font position '-1'
grodvi:<standard input>:5: bad font position '-1'
grops:<standard input>:5: bad font position '-1'


G. Branden Robinson <gbranden>
Group administrator
Wed 26 Jun 2019 04:38:12 PM UTC, comment #3: 

grotty's own coredump distills the hilarity.

I exported CFLAGS=-O0 and CPPFLAGS=-O0 and rebuilt, to no avail.

(This also affects groff 1.22.4 in Debian buster.)


Core was generated by `grotty'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  tty_printer::set_char (this=0x563eea2a7e00, g=<optimized out>, f=0x1, env=0x563eea2a67b0, w=0) at ../src/devices/grotty/tty.cpp:339
339       add_char(f->get_code(g), w,
##(gdb) bt
#0  tty_printer::set_char (this=0x563eea2a7e00, g=<optimized out>, f=0x1, env=0x563eea2a67b0, w=0) at ../src/devices/grotty/tty.cpp:339
#1  0x0000563ee889729c in printer::set_ascii_char (this=0x563eea2a7e00, c=<optimized out>, env=0x563eea2a67b0,
    widthp=widthp@entry=0x7ffc98fcd4d0) at ../src/libs/libdriver/printer.cpp:181
#2  0x0000563ee8896693 in do_file (filename=<optimized out>) at ../src/libs/libdriver/input.cpp:1781
#3  0x0000563ee88926e2 in main (argc=1, argv=0x7ffc98fcd618) at ../src/devices/grotty/tty.cpp:916
##(gdb) quit


G. Branden Robinson <gbranden>
Group administrator
Wed 26 Jun 2019 04:23:23 PM UTC, comment #2: 


Core was generated by `grops'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000556ff8db032a in font::get_code (this=this@entry=0x1, g=g@entry=0x0) at ../src/libs/libgroff/font.cpp:547
547       int idx = glyph_to_index(g);
##(gdb) bt
#0  0x0000556ff8db032a in font::get_code (this=this@entry=0x1, g=g@entry=0x0) at ../src/libs/libgroff/font.cpp:547
#1  0x0000556ff8da5bd7 in ps_printer::set_subencoding (this=this@entry=0x556ffa8f6150, f=f@entry=0x1, g=0x0,
    codep=codep@entry=0x7fff0563101f "") at ../src/devices/grops/ps.cpp:660
#2  0x0000556ff8da7532 in ps_printer::set_char (this=0x556ffa8f6150, g=<optimized out>, f=0x1, env=0x556ffa8ec9e0, w=0)
    at ../src/devices/grops/ps.cpp:693
#3  0x0000556ff8dadebc in printer::set_ascii_char (this=0x556ffa8f6150, c=<optimized out>, env=0x556ffa8ec9e0,
    widthp=widthp@entry=0x7fff056310c0) at ../src/libs/libdriver/printer.cpp:181
#4  0x0000556ff8dad2b3 in do_file (filename=filename@entry=0x556ff8db9b2a "-") at ../src/libs/libdriver/input.cpp:1781
#5  0x0000556ff8da3a9a in main (argc=1, argv=0x7fff05631258) at ../src/devices/grops/ps.cpp:1861


G. Branden Robinson <gbranden>
Group administrator
Wed 26 Jun 2019 04:04:28 PM UTC, comment #1: 

grops cores, too.

Our output processors are not coping with malformed "t" ditroff commands very robustly, it seems.


x T ps
x res 72000 1 1
x init
p1
tr
x trailer
V792000
x stop


G. Branden Robinson <gbranden>
Group administrator
Wed 26 Jun 2019 03:51:56 PM UTC, original submission:  

It's okay to give up on hopelessly corrupt input, but we shouldn't drop core.


$ nroff crash.nroff
grotty:<standard input>:5: bad font position '-1'
groff: grotty: Signal 11 (core dumped)
$ od -c crash.nroff
0000000   \   !   t   r  \n
0000005


G. Branden Robinson <gbranden>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #47136:  groff_56555.diff added by gbranden (524B - text/x-patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by gbranden (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 10 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-10-05 gbranden CategoryDriver grops Driver - others/general
        SummaryI can make grops and grotty core dump with 5 bytes of input [libdriver] I can make grops and grotty core dump with 5 bytes of input
    2019-06-26 gbranden StatusReady for Merge Fixed
        Open/ClosedOpen Closed
        Planned ReleaseNone 1.23.0
    2019-06-26 gbranden Attached File- Added groff_56555.diff, #47136
    2019-06-26 gbranden StatusNone Ready for Merge
        Assigned toNone gbranden
    2019-06-26 gbranden SummaryI can make grotty core dump with 5 bytes of input I can make grops and grotty core dump with 5 bytes of input
    2019-06-26 gbranden CategoryDriver - others/general Driver grops

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code