[bug #68552] [troff] double-free via `exit()` in `write_any_trailer_and_exit()` using Clang on Termux
"G. Branden Robinson" <[email protected]> Fri, 24 Jul 2026 00:03:11 -0400 (EDT)
| Newsgroups | gmane.comp.printing.groff.bugs |
|---|---|
| Message-ID | <[email protected]> |
--8323329-1714636915-1784865791=:1716346
Content-Type: TEXT/plain; CHARSET=utf-8
Content-Transfer-Encoding: QUOTED-PRINTABLE
Content-Disposition: inline
Update of bug #68552 (group groff):=0A=0A Category: =
None =3D> Core=0A Severity: 2 - Min=
or =3D> 4 - Important=0A Status: Need Info =
=3D> Confirmed=0A Assigned to: None =3D> gbr=
anden=0A Summary: [not our problem?] null pointer dereferen=
ce in=0A`write_any_trailer_and_exit()` using Clang on Termux =3D> [troff] d=
ouble-free=0Avia `exit()` in `write_any_trailer_and_exit()` using Clang on =
Termux=0A=0A _______________________________________________________=0A=
=0AFollow-up Comment #2:=0A=0A[https://lists.gnu.org/archive/html/groff/202=
6-07/msg00044.html Bruno steered=0Ame well.]=0A=0A=0A> I happened upon a ba=
ffling bug today.=0A> =0A> https://savannah.gnu.org/bugs/?68552=0A=0Aexit()=
runs the destructors of global C++ objects [1], while quick_exit()=0Adoesn=
't [2].=0A=0ADoes the crash persist of you call quick_exit() instead of exi=
t()?=0A=0ABruno=0A=0A[1] https://en.cppreference.com/cpp/utility/program/ex=
it=0A[2] https://en.cppreference.com/cpp/utility/program/quick_exit=0A=0A=
=0AThe bug disappears if I replace `exit()` with `quick_exit()` _and_ it do=
es not=0Areproduce from a _groff_ 1.24.1 distribution archive build, which =
means this=0Areally is a regression, and likely one I introduced. Damn.=0A=
=0AThe sun will become a red giant before I can achieve a build-demanding=
=0Abisection of 1,000+ commits on my tablet.=0A=0AI'll have to find out if =
I can get LLDB to tell me _which_ object's destructor=0Ais attempting the r=
edundant free/delete. Maybe ASAN can help with that.=0A=0A=0A _________=
______________________________________________=0A=0AReply to this item at:=
=0A=0A <https://savannah.gnu.org/bugs/?68552>=0A=0A_______________________=
________________________=0AMessage sent via Savannah=0Ahttps://savannah.gnu=
.org/=0A
--8323329-1714636915-1784865791=:1716346
Content-Type: APPLICATION/pgp-signature; name=signature.asc
-----BEGIN PGP SIGNATURE-----
iHUEABYIAB0WIQQk97aszIMMAvLLwm6qLAuaBUf3TgUCamLj/wAKCRCqLAuaBUf3
Tpo+AQDqQy/JGEusFKNwH1os4cMRWr1RL0ihSc5PypF4bDmPKwD/WfPzUW9K7QPX
QjKSsj7Bh1xyqIBeDesDfEUfwhRxfwc=
=+pbY
-----END PGP SIGNATURE-----
--8323329-1714636915-1784865791=:1716346--