[bug #68560] [PATCH] [grops] ASAN reports 1-byte heap overread with certain invalid `import` device extension command arguments
"G. Branden Robinson" <[email protected]> Fri, 24 Jul 2026 19:44:44 -0400 (EDT)
| Newsgroups | gmane.comp.printing.groff.bugs |
|---|---|
| Message-ID | <[email protected]> |
--8323329-1714636915-1784936684=:853141
Content-Type: TEXT/plain; CHARSET=utf-8
Content-Transfer-Encoding: QUOTED-PRINTABLE
Content-Disposition: inline
URL:=0A <https://savannah.gnu.org/bugs/?68560>=0A=0A Summa=
ry: [PATCH] [grops] ASAN reports 1-byte heap overread=0Awith certain invali=
d `import` device extension command arguments=0A Group: G=
NU roff=0A Submitter: gbranden=0A Submitted: Fr=
i 24 Jul 2026 11:44:40 PM UTC=0A Category: Driver grops=0A =
Severity: 4 - Important=0A Item Group: Crash/Unr=
esponsive=0A Status: In Progress=0A Privac=
y: Public=0A Assigned to: gbranden=0A Open/Closed: =
Open=0A Discussion Lock: Unlocked=0A Planned Release: None=
=0A=0A=0A _______________________________________________________=0A=0AF=
ollow-up Comments:=0A=0A=0A------------------------------------------------=
-------=0ADate: Fri 24 Jul 2026 11:44:40 PM UTC By: G. Branden Robinson <gb=
randen>=0ABruno Haible and I independently encountered this problem while h=
itting=0A_groff_ 1.25.0.rc1 with the ASAN hammer.=0A=0A[https://lists.gnu.o=
rg/archive/html/groff/2026-07/msg00053.html His report to=0Athe mailing lis=
t is well-organized.]=0A=0A=0AI tried building the groff-1.25.0.rc1 with cl=
ang's ASAN.=0AThe next finding:=0A=0A GROFF doc/webpage.ps=0A=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=0A=3D=3D850822=3D=3DERROR: AddressSani=
tizer: heap-buffer-overflow on address =0A0x7667d11e0291 at pc 0x639af6237a=
11 bp 0x7ffd0e103b90 sp 0x7ffd0e103b88=0AREAD of size 1 at 0x7667d11e0291 t=
hread T0=0A #0 0x639af6237a10 in ps_printer::do_import(char*, environmen=
t const*) =0A/build/groff-1.25.0.rc1/build-64-clang/../src/devices/grops/ps=
.cpp:1870:11=0A #1 0x639af6235d48 in ps_printer::special(char*, environm=
ent const*, char)=0A=0A/build/groff-1.25.0.rc1/build-64-clang/../src/device=
s/grops/ps.cpp:1734:7=0A #2 0x639af6253ef4 in parse_x_command() =0A/buil=
d/groff-1.25.0.rc1/build-64-clang/../src/libs/libdriver/input.cpp:1530:6=0A=
#3 0x639af625725f in interpret_troff_output_file(char const*) =0A/build=
/groff-1.25.0.rc1/build-64-clang/../src/libs/libdriver/input.cpp:1827:17=0A=
#4 0x639af623a810 in main =0A/build/groff-1.25.0.rc1/build-64-clang/../=
src/devices/grops/ps.cpp:2053:5=0A #5 0x7a07d1e2a600 in __libc_start_cal=
l_main =0Acsu/../sysdeps/nptl/libc_start_call_main.h:59:16=0A #6 0x7a07d=
1e2a717 in __libc_start_main csu/../csu/libc-start.c:360:3=0A #7 0x639af=
612ce34 in _start =0A(/build/groff-1.25.0.rc1/build-64-clang/grops+0x85e34)=
=0A=0A0x7667d11e0291 is located 0 bytes after 49-byte region =0A[0x7667d11e=
0260,0x7667d11e0291)=0Aallocated by thread T0 here:=0A #0 0x639af62154fd=
in operator new[](unsigned long) =0A/home/runner/work/llvm-project/llvm-pr=
oject/compiler-rt/lib/asan/asan_new_delete.cpp:111:37=0A #1 0x639af624eb=
10 in StringBuf::make_string() =0A/build/groff-1.25.0.rc1/build-64-clang/..=
/src/libs/libdriver/input.cpp:568:18=0A #2 0x639af625072c in get_extende=
d_arg() =0A/build/groff-1.25.0.rc1/build-64-clang/../src/libs/libdriver/inp=
ut.cpp:773:14=0A #3 0x639af6253d26 in parse_x_command() =0A/build/groff-=
1.25.0.rc1/build-64-clang/../src/libs/libdriver/input.cpp:1523:23=0A #4 =
0x639af625725f in interpret_troff_output_file(char const*) =0A/build/groff-=
1.25.0.rc1/build-64-clang/../src/libs/libdriver/input.cpp:1827:17=0A #5 =
0x639af623a810 in main =0A/build/groff-1.25.0.rc1/build-64-clang/../src/dev=
ices/grops/ps.cpp:2053:5=0A #6 0x7a07d1e2a600 in __libc_start_call_main =
=0Acsu/../sysdeps/nptl/libc_start_call_main.h:59:16=0A #7 0x7a07d1e2a717=
in __libc_start_main csu/../csu/libc-start.c:360:3=0A #8 0x639af612ce34=
in _start =0A(/build/groff-1.25.0.rc1/build-64-clang/grops+0x85e34)=0A=0AS=
UMMARY: AddressSanitizer: heap-buffer-overflow =0A/build/groff-1.25.0.rc1/b=
uild-64-clang/../src/devices/grops/ps.cpp:1870:11 in=0A=0Aps_printer::do_im=
port(char*, environment const*)=0AShadow bytes around the buggy address:=0A=
0x7667d11e0000: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa=0A 0x766=
7d11e0080: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00=0A 0x7667d11e01=
00: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00=0A 0x7667d11e0180: fa =
fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa=0A 0x7667d11e0200: 00 00 00 0=
0 00 00 00 00 fa fa fa fa 00 00 00 00=0A=3D>0x7667d11e0280: 00 00[01]fa fa =
fa fa fa fa fa fa fa fa fa fa fa=0A 0x7667d11e0300: fa fa fa fa fa fa fa f=
a fa fa fa fa fa fa fa fa=0A 0x7667d11e0380: fa fa fa fa fa fa fa fa fa fa=
fa fa fa fa fa fa=0A 0x7667d11e0400: fa fa fa fa fa fa fa fa fa fa fa fa =
fa fa fa fa=0A 0x7667d11e0480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f=
a fa=0A 0x7667d11e0500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa=0A=
Shadow byte legend (one shadow byte represents 8 application bytes):=0A Ad=
dressable: 00=0A Partially addressable: 01 02 03 04 05 06 07 =0A=
Heap left redzone: fa=0A Freed heap region: fd=0A Stack lef=
t redzone: f1=0A Stack mid redzone: f2=0A Stack right redzone:=
f3=0A Stack after return: f5=0A Stack use after scope: f8=0A =
Global redzone: f9=0A Global init order: f6=0A Poisoned b=
y user: f7=0A Container overflow: fc=0A Array cookie: =
ac=0A Intra object redzone: bb=0A ASan internal: fe=0A =
Left alloca redzone: ca=0A Right alloca redzone: cb=0A=3D=3D850822=
=3D=3DABORTING=0A/build/groff-1.25.0.rc1/build-64-clang/groff: error: grops=
: Aborted=0Amake[2]: *** [Makefile:19776: doc/webpage.ps] Error 8=0A=0A=0A"=
READ of size 1" with "is located 0 bytes after 49-byte region" obviously=0A=
means that the memory block should have been 50 bytes large, not 49.=0A=0AB=
runo=0A=0A=0AI believe this fixes it:=0A=0A=0Adiff --git a/ChangeLog b/Chan=
geLog=0Aindex f134a619b..3182b8095 100644=0A--- a/ChangeLog=0A+++ b/ChangeL=
og=0A@@ -1,3 +1,15 @@=0A+2026-07-24 G. Branden Robinson <g.branden.robinso=
[email protected]>=0A+=0A+ * src/devices/grops/ps.cpp (ps_printer::do_impor=
t): Revise to=0A+ avoid overreading heap by one byte with certain ill=
-formed=0A+ argument to the `import` device extension command. Recas=
t=0A+ error diagnostic to report the full contents of the invalid=0A+=
argument and characterize it simply as "invalid" due to=0A+ no=
n-numeric contents.=0A+=0A+ Fixes <https://savannah.gnu.org/bugs/?68?=
??>. Problem=0A+ introduced by me in commit 9f050b7ed7, 7 May.=0A+=
=0A 2026-07-24 G. Branden Robinson <[email protected]>=0A =0A =
* src/devices/grops/ps.cpp (ps_printer::do_import): Fix=0Adiff --git =
a/src/devices/grops/ps.cpp b/src/devices/grops/ps.cpp=0Aindex d937d3615..75=
5e34450 100644=0A--- a/src/devices/grops/ps.cpp=0A+++ b/src/devices/grops/p=
s.cpp=0A@@ -1852,6 +1852,8 @@ void ps_printer::do_import(char *arg, const e=
nvironment=0A*env)=0A while ((' ' =3D=3D *arg) || ('\n' =3D=3D *arg))=0A =
arg++;=0A char *p;=0A+ // Skip validation of first argument, a file =
name.=0A+ // XXX: This means we can't import file names with spaces in the=
m.=0A for (p =3D arg; (*p !=3D '\0') && (*p !=3D ' ') && (*p !=3D '\n'); =
p++)=0A ;=0A if (*p !=3D '\0')=0A@@ -1866,11 +1868,15 @@ void ps_prin=
ter::do_import(char *arg, const=0Aenvironment *env)=0A parms[nparms++] =
=3D int(n);=0A p =3D end;=0A }=0A- if ((csalpha(*p) && (p[1] =3D=3D =
'\0'))=0A- || (p[1] =3D=3D ' ')=0A- || (p[1] =3D=3D '\n')) {=0A- =
error("scaling unit '%1' not allowed in argument to"=0A- "device=
extension command 'import'", p[1]);=0A+ size_t idx =3D 0;=0A+ if (strlen=
(p) > 1)=0A+ idx =3D 1;=0A+ if (!csdigit(p[idx])=0A+ && (p[idx] !=
=3D ' ')=0A+ && (p[idx] !=3D '\n')=0A+ && (p[idx] !=3D '\0')) {=
=0A+ error("invalid numeric argument(s) '%1'"=0A+ " to device ex=
tension command 'import'", p);=0A return;=0A }=0A while ((' ' =3D=
=3D *p) || ('\n' =3D=3D *p))=0A=0A=0A=0A=0A=0A=0A=0A=0A=0A _____________=
__________________________________________=0A=0AReply to this item at:=0A=
=0A <https://savannah.gnu.org/bugs/?68560>=0A=0A__________________________=
_____________________=0AMessage sent via Savannah=0Ahttps://savannah.gnu.or=
g/=0A
--8323329-1714636915-1784936684=:853141
Content-Type: APPLICATION/pgp-signature; name=signature.asc
-----BEGIN PGP SIGNATURE-----
iHUEABYIAB0WIQQk97aszIMMAvLLwm6qLAuaBUf3TgUCamP47AAKCRCqLAuaBUf3
TjpeAQDpZLcJE+UAU6K+1hvj3EH1xu/oMfUE5iIbVumSVQ8cigEA81w4ZBx2hQTq
WnExRQRb5EVpLwq6TYik04CKvyW0Kwc=
=F2uM
-----END PGP SIGNATURE-----
--8323329-1714636915-1784936684=:853141--