[bug #68555] [PATCH] [troff] ASAN runtime error: 1-byte heap overread in `print_hyphenation_exceptions_request()`

"G. Branden Robinson" <[email protected]> Fri, 24 Jul 2026 03:16:41 -0400 (EDT)
Newsgroups gmane.comp.printing.groff.bugs
Message-ID <[email protected]>
--8323329-1714636915-1784877401=:2612271
Content-Type: TEXT/plain; CHARSET=utf-8
Content-Transfer-Encoding: QUOTED-PRINTABLE
Content-Disposition: inline

URL:=0A  <https://savannah.gnu.org/bugs/?68555>=0A=0A                 Summa=
ry: [PATCH] [troff] ASAN runtime error: 1-byte heap=0Aoverread in `print_hy=
phenation_exceptions_request()`=0A                   Group: GNU roff=0A    =
           Submitter: gbranden=0A               Submitted: Fri 24 Jul 2026 =
07:16:37 AM UTC=0A                Category: Core=0A                Severity=
: 4 - Important=0A              Item Group: Crash/Unresponsive=0A          =
        Status: In Progress=0A                 Privacy: Public=0A          =
   Assigned to: gbranden=0A             Open/Closed: Open=0A         Discus=
sion Lock: Unlocked=0A         Planned Release: None=0A=0A=0A    __________=
_____________________________________________=0A=0AFollow-up Comments:=0A=
=0A=0A-------------------------------------------------------=0ADate: Fri 2=
4 Jul 2026 07:16:37 AM UTC By: G. Branden Robinson <gbranden>=0AIllustratio=
n with instrumented function.=0A=0AMy code for dumping hyphenation exceptio=
n words didn't properly handle the=0Acase where the exception word has no h=
yphenation points at all.  (It issued a=0Acorrect _report_, but read one by=
te too far while doing so.)=0A=0A=0A$ ../src/roff/groff/tests/phw-request-w=
orks.sh =0Abaz-qux=0Atab-le=0Atroff:<standard input>:6: debug: GBR: print_h=
yphenation_exceptions_request:=0Aword=3Dimagemagick =0Atroff:<standard inpu=
t>:6: debug: GBR: print_hyphenation_exceptions_request:=0Ai=3D0, hypoint is=
 not null=0Atroff:<standard input>:6: debug: GBR: print_hyphenation_excepti=
ons_request:=0Ai=3D1, hypoint is not null=0Atroff:<standard input>:6: debug=
: GBR: print_hyphenation_exceptions_request:=0Ai=3D2, hypoint is not null=
=0Atroff:<standard input>:6: debug: GBR: print_hyphenation_exceptions_reque=
st:=0Ai=3D3, hypoint is not null=0Atroff:<standard input>:6: debug: GBR: pr=
int_hyphenation_exceptions_request:=0Ai=3D4, hypoint is not null=0Atroff:<s=
tandard input>:6: debug: GBR: print_hyphenation_exceptions_request:=0Ai=3D5=
, hypoint is not null=0Atroff:<standard input>:6: debug: GBR: print_hyphena=
tion_exceptions_request:=0Ai=3D6, hypoint is not null=0Atroff:<standard inp=
ut>:6: debug: GBR: print_hyphenation_exceptions_request:=0Ai=3D7, hypoint i=
s not null=0Atroff:<standard input>:6: debug: GBR: print_hyphenation_except=
ions_request:=0Ai=3D8, hypoint is not null=0Atroff:<standard input>:6: debu=
g: GBR: print_hyphenation_exceptions_request:=0Ai=3D9, hypoint is not null=
=0Atroff:<standard input>:6: debug: GBR: print_hyphenation_exceptions_reque=
st:=0Ai=3D10, hypoint is not null=0Atroff:<standard input>:6: debug: GBR: p=
rint_hyphenation_exceptions_request:=0Ai=3D11, hypoint is not null=0Aimage-=
magick    *=0Atroff:<standard input>:6: debug: GBR: print_hyphenation_excep=
tions_request:=0Aword=3Dxviiith =0Atroff:<standard input>:6: debug: GBR: pr=
int_hyphenation_exceptions_request:=0Ai=3D0, hypoint is not null=0Atroff:<s=
tandard input>:6: debug: GBR: print_hyphenation_exceptions_request:=0Ai=3D1=
, hypoint is not null=0A=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=0A=3D=
=3D30964=3D=3DERROR: AddressSanitizer: heap-buffer-overflow on address=0A0x=
6020000d0971 at pc 0x55f01f0aaad2 bp 0x7fff495510b0 sp 0x7fff495510a8=0AREA=
D of size 1 at 0x6020000d0971 thread T0=0A    #0 0x55f01f0aaad1 in print_hy=
phenation_exceptions_request=0A../src/roff/troff/env.cpp:4196=0A    #1 0x55=
f01f0ae135 in request::invoke(symbol, bool)=0A../src/roff/troff/input.cpp:3=
921=0A    #2 0x55f01f0bffff in interpolate_macro_or_invoke_request=0A../src=
/roff/troff/input.cpp:4755=0A    #3 0x55f01f0c9ca1 in process_input_stack()=
=0A../src/roff/troff/input.cpp:3649=0A    #4 0x55f01f0de526 in process_inpu=
t_file ../src/roff/troff/input.cpp:9948=0A    #5 0x55f01f0ed58e in main ../=
src/roff/troff/input.cpp:10319=0A    #6 0x7f868028bd79 in __libc_start_main=
 ../csu/libc-start.c:308=0A    #7 0x55f01f03e7e9 in _start=0A(/home/branden=
/src/GIT/groff/build/troff+0xbe7e9)=0A=0A0x6020000d0971 is located 0 bytes =
to the right of 1-byte region=0A[0x6020000d0970,0x6020000d0971)=0Aallocated=
 by thread T0 here:=0A    #0 0x7f86808127a7 in operator new[](unsigned long=
)=0A../../../../src/libsanitizer/asan/asan_new_delete.cpp:102=0A    #1 0x55=
f01f07bac6 in hyphen_trie::insert_hyphenation(dictionary*, char=0Aconst*, i=
nt) ../src/roff/troff/env.cpp:4331=0A    #2 0x55f01f07bac6 in hyphen_trie::=
interpret_patterns_file(char const*,=0Abool, dictionary*) ../src/roff/troff=
/env.cpp:4574=0A=0ASUMMARY: AddressSanitizer: heap-buffer-overflow ../src/r=
off/troff/env.cpp:4196=0Ain print_hyphenation_exceptions_request=0AShadow b=
ytes around the buggy address:=0A  0x0c04800120d0: fa fa 01 fa fa fa 02 fa =
fa fa 01 fa fa fa 03 fa=0A  0x0c04800120e0: fa fa 02 fa fa fa 02 fa fa fa 0=
1 fa fa fa 01 fa=0A  0x0c04800120f0: fa fa 02 fa fa fa 03 fa fa fa 02 fa fa=
 fa 03 fa=0A  0x0c0480012100: fa fa 03 fa fa fa 02 fa fa fa 04 fa fa fa 02 =
fa=0A  0x0c0480012110: fa fa 02 fa fa fa 01 fa fa fa 01 fa fa fa 03 fa=0A=
=3D>0x0c0480012120: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa[01]fa=0A  0x0=
c0480012130: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa 02 fa=0A  0x0c048001=
2140: fa fa 02 fa fa fa 02 fa fa fa 03 fa fa fa fd fd=0A  0x0c0480012150: f=
a fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd=0A  0x0c0480012160: fa fa fd=
 fd fa fa fd fd fa fa fd fd fa fa fd fd=0A  0x0c0480012170: fa fa fd fd fa =
fa fd fd fa fa fd fd fa fa fd fd=0AShadow byte legend (one shadow byte repr=
esents 8 application bytes):=0A  Addressable:           00=0A  Partially ad=
dressable: 01 02 03 04 05 06 07 =0A  Heap left redzone:       fa=0A  Freed =
heap region:       fd=0A  Stack left redzone:      f1=0A  Stack mid redzone=
:       f2=0A  Stack right redzone:     f3=0A  Stack after return:      f5=
=0A  Stack use after scope:   f8=0A  Global redzone:          f9=0A  Global=
 init order:       f6=0A  Poisoned by user:        f7=0A  Container overflo=
w:      fc=0A  Array cookie:            ac=0A  Intra object redzone:    bb=
=0A  ASan internal:           fe=0A  Left alloca redzone:     ca=0A  Right =
alloca redzone:    cb=0A  Shadow gap:              cc=0A=3D=3D30964=3D=3DAB=
ORTING=0A=0A=0AI have a fix.=0A=0A=0A$ git diff src/roff/=0Adiff --git a/sr=
c/roff/troff/env.cpp b/src/roff/troff/env.cpp=0Aindex 5b2cbaf7c..e8d3ed1c8 =
100644=0A--- a/src/roff/troff/env.cpp=0A+++ b/src/roff/troff/env.cpp=0A@@ -=
4189,6 +4189,7 @@ static void print_hyphenation_exceptions_request() //=0A.=
phw=0A     (void) memset(wordbuf, '\0', bufsz);=0A     size_t i =3D 0, j =
=3D 0, len =3D word.length();=0A     bool is_mode_dependent =3D false;=0A+ =
   if (*hypoint !=3D 0) {=0A     while (i < len) {=0A       if ((hypoint !=
=3D 0 /* nullptr */) && (*hypoint =3D=3D i)) {=0A        wordbuf[j++] =3D '=
-';=0A@@ -4203,6 +4204,7 @@ static void print_hyphenation_exceptions_reques=
t() //=0A.phw=0A       }=0A       wordbuf[j++] =3D word[i++];=0A     }=0A+ =
   }=0A     errprint("%1", wordbuf);=0A     if (is_mode_dependent)=0A      =
 errprint("\t*");=0A=0A=0AIndentation will need to be updated.  And as a bo=
nus this change avoids=0Aunnecessary work...not like the `phw` request is a=
 hot path, though.=0A=0A=0A=0A=0A=0A=0A=0A    _____________________________=
__________________________=0A=0AReply to this item at:=0A=0A  <https://sava=
nnah.gnu.org/bugs/?68555>=0A=0A____________________________________________=
___=0AMessage sent via Savannah=0Ahttps://savannah.gnu.org/=0A
--8323329-1714636915-1784877401=:2612271
Content-Type: APPLICATION/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iHUEABYIAB0WIQQk97aszIMMAvLLwm6qLAuaBUf3TgUCamMRWQAKCRCqLAuaBUf3
Tlv4AQDQ1mjSxYKigerC3PbQeQ8ACsVFvv+tuGYAI0YtrXAu1AD8CZ6bJFvwTJ0y
WIE0gwVliw/NILb4Py/SLFAHnQ1AJg4=
=wfYP
-----END PGP SIGNATURE-----

--8323329-1714636915-1784877401=:2612271--