[bug #68555] [PATCH] [troff] ASAN runtime error: 1-byte heap overread in `print_hyphenation_exceptions_request()`
"G. Branden Robinson" <[email protected]> Fri, 24 Jul 2026 03:16:41 -0400 (EDT)
| Newsgroups | gmane.comp.printing.groff.bugs |
|---|---|
| Message-ID | <[email protected]> |
--8323329-1714636915-1784877401=:2612271
Content-Type: TEXT/plain; CHARSET=utf-8
Content-Transfer-Encoding: QUOTED-PRINTABLE
Content-Disposition: inline
URL:=0A <https://savannah.gnu.org/bugs/?68555>=0A=0A Summa=
ry: [PATCH] [troff] ASAN runtime error: 1-byte heap=0Aoverread in `print_hy=
phenation_exceptions_request()`=0A Group: GNU roff=0A =
Submitter: gbranden=0A Submitted: Fri 24 Jul 2026 =
07:16:37 AM UTC=0A Category: Core=0A Severity=
: 4 - Important=0A Item Group: Crash/Unresponsive=0A =
Status: In Progress=0A Privacy: Public=0A =
Assigned to: gbranden=0A Open/Closed: Open=0A Discus=
sion Lock: Unlocked=0A Planned Release: None=0A=0A=0A __________=
_____________________________________________=0A=0AFollow-up Comments:=0A=
=0A=0A-------------------------------------------------------=0ADate: Fri 2=
4 Jul 2026 07:16:37 AM UTC By: G. Branden Robinson <gbranden>=0AIllustratio=
n with instrumented function.=0A=0AMy code for dumping hyphenation exceptio=
n words didn't properly handle the=0Acase where the exception word has no h=
yphenation points at all. (It issued a=0Acorrect _report_, but read one by=
te too far while doing so.)=0A=0A=0A$ ../src/roff/groff/tests/phw-request-w=
orks.sh =0Abaz-qux=0Atab-le=0Atroff:<standard input>:6: debug: GBR: print_h=
yphenation_exceptions_request:=0Aword=3Dimagemagick =0Atroff:<standard inpu=
t>:6: debug: GBR: print_hyphenation_exceptions_request:=0Ai=3D0, hypoint is=
not null=0Atroff:<standard input>:6: debug: GBR: print_hyphenation_excepti=
ons_request:=0Ai=3D1, hypoint is not null=0Atroff:<standard input>:6: debug=
: GBR: print_hyphenation_exceptions_request:=0Ai=3D2, hypoint is not null=
=0Atroff:<standard input>:6: debug: GBR: print_hyphenation_exceptions_reque=
st:=0Ai=3D3, hypoint is not null=0Atroff:<standard input>:6: debug: GBR: pr=
int_hyphenation_exceptions_request:=0Ai=3D4, hypoint is not null=0Atroff:<s=
tandard input>:6: debug: GBR: print_hyphenation_exceptions_request:=0Ai=3D5=
, hypoint is not null=0Atroff:<standard input>:6: debug: GBR: print_hyphena=
tion_exceptions_request:=0Ai=3D6, hypoint is not null=0Atroff:<standard inp=
ut>:6: debug: GBR: print_hyphenation_exceptions_request:=0Ai=3D7, hypoint i=
s not null=0Atroff:<standard input>:6: debug: GBR: print_hyphenation_except=
ions_request:=0Ai=3D8, hypoint is not null=0Atroff:<standard input>:6: debu=
g: GBR: print_hyphenation_exceptions_request:=0Ai=3D9, hypoint is not null=
=0Atroff:<standard input>:6: debug: GBR: print_hyphenation_exceptions_reque=
st:=0Ai=3D10, hypoint is not null=0Atroff:<standard input>:6: debug: GBR: p=
rint_hyphenation_exceptions_request:=0Ai=3D11, hypoint is not null=0Aimage-=
magick *=0Atroff:<standard input>:6: debug: GBR: print_hyphenation_excep=
tions_request:=0Aword=3Dxviiith =0Atroff:<standard input>:6: debug: GBR: pr=
int_hyphenation_exceptions_request:=0Ai=3D0, hypoint is not null=0Atroff:<s=
tandard input>:6: debug: GBR: print_hyphenation_exceptions_request:=0Ai=3D1=
, hypoint is not null=0A=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=0A=3D=
=3D30964=3D=3DERROR: AddressSanitizer: heap-buffer-overflow on address=0A0x=
6020000d0971 at pc 0x55f01f0aaad2 bp 0x7fff495510b0 sp 0x7fff495510a8=0AREA=
D of size 1 at 0x6020000d0971 thread T0=0A #0 0x55f01f0aaad1 in print_hy=
phenation_exceptions_request=0A../src/roff/troff/env.cpp:4196=0A #1 0x55=
f01f0ae135 in request::invoke(symbol, bool)=0A../src/roff/troff/input.cpp:3=
921=0A #2 0x55f01f0bffff in interpolate_macro_or_invoke_request=0A../src=
/roff/troff/input.cpp:4755=0A #3 0x55f01f0c9ca1 in process_input_stack()=
=0A../src/roff/troff/input.cpp:3649=0A #4 0x55f01f0de526 in process_inpu=
t_file ../src/roff/troff/input.cpp:9948=0A #5 0x55f01f0ed58e in main ../=
src/roff/troff/input.cpp:10319=0A #6 0x7f868028bd79 in __libc_start_main=
../csu/libc-start.c:308=0A #7 0x55f01f03e7e9 in _start=0A(/home/branden=
/src/GIT/groff/build/troff+0xbe7e9)=0A=0A0x6020000d0971 is located 0 bytes =
to the right of 1-byte region=0A[0x6020000d0970,0x6020000d0971)=0Aallocated=
by thread T0 here:=0A #0 0x7f86808127a7 in operator new[](unsigned long=
)=0A../../../../src/libsanitizer/asan/asan_new_delete.cpp:102=0A #1 0x55=
f01f07bac6 in hyphen_trie::insert_hyphenation(dictionary*, char=0Aconst*, i=
nt) ../src/roff/troff/env.cpp:4331=0A #2 0x55f01f07bac6 in hyphen_trie::=
interpret_patterns_file(char const*,=0Abool, dictionary*) ../src/roff/troff=
/env.cpp:4574=0A=0ASUMMARY: AddressSanitizer: heap-buffer-overflow ../src/r=
off/troff/env.cpp:4196=0Ain print_hyphenation_exceptions_request=0AShadow b=
ytes around the buggy address:=0A 0x0c04800120d0: fa fa 01 fa fa fa 02 fa =
fa fa 01 fa fa fa 03 fa=0A 0x0c04800120e0: fa fa 02 fa fa fa 02 fa fa fa 0=
1 fa fa fa 01 fa=0A 0x0c04800120f0: fa fa 02 fa fa fa 03 fa fa fa 02 fa fa=
fa 03 fa=0A 0x0c0480012100: fa fa 03 fa fa fa 02 fa fa fa 04 fa fa fa 02 =
fa=0A 0x0c0480012110: fa fa 02 fa fa fa 01 fa fa fa 01 fa fa fa 03 fa=0A=
=3D>0x0c0480012120: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa[01]fa=0A 0x0=
c0480012130: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa 02 fa=0A 0x0c048001=
2140: fa fa 02 fa fa fa 02 fa fa fa 03 fa fa fa fd fd=0A 0x0c0480012150: f=
a fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd=0A 0x0c0480012160: fa fa fd=
fd fa fa fd fd fa fa fd fd fa fa fd fd=0A 0x0c0480012170: fa fa fd fd fa =
fa fd fd fa fa fd fd fa fa fd fd=0AShadow byte legend (one shadow byte repr=
esents 8 application bytes):=0A Addressable: 00=0A Partially ad=
dressable: 01 02 03 04 05 06 07 =0A Heap left redzone: fa=0A Freed =
heap region: fd=0A Stack left redzone: f1=0A Stack mid redzone=
: f2=0A Stack right redzone: f3=0A Stack after return: f5=
=0A Stack use after scope: f8=0A Global redzone: f9=0A Global=
init order: f6=0A Poisoned by user: f7=0A Container overflo=
w: fc=0A Array cookie: ac=0A Intra object redzone: bb=
=0A ASan internal: fe=0A Left alloca redzone: ca=0A Right =
alloca redzone: cb=0A Shadow gap: cc=0A=3D=3D30964=3D=3DAB=
ORTING=0A=0A=0AI have a fix.=0A=0A=0A$ git diff src/roff/=0Adiff --git a/sr=
c/roff/troff/env.cpp b/src/roff/troff/env.cpp=0Aindex 5b2cbaf7c..e8d3ed1c8 =
100644=0A--- a/src/roff/troff/env.cpp=0A+++ b/src/roff/troff/env.cpp=0A@@ -=
4189,6 +4189,7 @@ static void print_hyphenation_exceptions_request() //=0A.=
phw=0A (void) memset(wordbuf, '\0', bufsz);=0A size_t i =3D 0, j =
=3D 0, len =3D word.length();=0A bool is_mode_dependent =3D false;=0A+ =
if (*hypoint !=3D 0) {=0A while (i < len) {=0A if ((hypoint !=
=3D 0 /* nullptr */) && (*hypoint =3D=3D i)) {=0A wordbuf[j++] =3D '=
-';=0A@@ -4203,6 +4204,7 @@ static void print_hyphenation_exceptions_reques=
t() //=0A.phw=0A }=0A wordbuf[j++] =3D word[i++];=0A }=0A+ =
}=0A errprint("%1", wordbuf);=0A if (is_mode_dependent)=0A =
errprint("\t*");=0A=0A=0AIndentation will need to be updated. And as a bo=
nus this change avoids=0Aunnecessary work...not like the `phw` request is a=
hot path, though.=0A=0A=0A=0A=0A=0A=0A=0A _____________________________=
__________________________=0A=0AReply to this item at:=0A=0A <https://sava=
nnah.gnu.org/bugs/?68555>=0A=0A____________________________________________=
___=0AMessage sent via Savannah=0Ahttps://savannah.gnu.org/=0A
--8323329-1714636915-1784877401=:2612271
Content-Type: APPLICATION/pgp-signature; name=signature.asc
-----BEGIN PGP SIGNATURE-----
iHUEABYIAB0WIQQk97aszIMMAvLLwm6qLAuaBUf3TgUCamMRWQAKCRCqLAuaBUf3
Tlv4AQDQ1mjSxYKigerC3PbQeQ8ACsVFvv+tuGYAI0YtrXAu1AD8CZ6bJFvwTJ0y
WIE0gwVliw/NILb4Py/SLFAHnQ1AJg4=
=wfYP
-----END PGP SIGNATURE-----
--8323329-1714636915-1784877401=:2612271--