[bug #68583] [PATCH] [troff] signed integer overflow in dictionary.cpp:is_good_size()

--8323329-1714636915-1785488235=:3221758
Content-Type: TEXT/plain; CHARSET=utf-8
Content-Transfer-Encoding: QUOTED-PRINTABLE
Content-Disposition: inline

URL:=0A  <https://savannah.gnu.org/bugs/?68583>=0A=0A                 Summa=
ry: [PATCH] [troff] signed integer overflow in=0Adictionary.cpp:is_good_siz=
e()=0A                   Group: GNU roff=0A               Submitter: gbrand=
en=0A               Submitted: Fri 31 Jul 2026 08:57:11 AM UTC=0A          =
      Category: Core=0A                Severity: 3 - Normal=0A             =
 Item Group: Incorrect behaviour=0A                  Status: In Progress=0A=
                 Privacy: Public=0A             Assigned to: gbranden=0A   =
          Open/Closed: Open=0A         Discussion Lock: Unlocked=0A        =
 Planned Release: None=0A=0A=0A    ________________________________________=
_______________=0A=0AFollow-up Comments:=0A=0A=0A--------------------------=
-----------------------------=0ADate: Fri 31 Jul 2026 08:57:11 AM UTC By: G=
. Branden Robinson <gbranden>=0A[https://lists.gnu.org/archive/html/groff/2=
026-07/msg00052.html Bruno reported=0Ato the _groff_ list]:=0A=0AI tried bu=
ilding the groff-1.25.0.rc1 with clang's ASAN (usually better than=0Agcc's =
ASAN) on a GNU system. For reference, I use these environment=0Avariables:=
=0A=0A=0ACC=3D"$HOME/inst-clang/22.1.0/bin/clang -Wl,-rpath,$HOME/inst-clan=
g/22.1.0/lib=0A-Wl,-rpath,$HOME/inst-clang/22.1.0/lib/x86_64-unknown-linux-=
gnu"=0ACXX=3D"$HOME/inst-clang/22.1.0/bin/clang++ -I/usr/include/c++/14=0A-=
I/usr/include/x86_64-linux-gnu/c++/11 -L/usr/lib/gcc/x86_64-linux-gnu/14=0A=
-Wl,-rpath,$HOME/inst-clang/22.1.0/lib=0A-Wl,-rpath,$HOME/inst-clang/22.1.0=
/lib/x86_64-unknown-linux-gnu"=0A=0ACC=3D"$CC=0A-fsanitize=3Daddress,undefi=
ned,signed-integer-overflow,shift,integer-divide-by-zero=0A-fno-sanitize-re=
cover=3Dundefined"; CXX=3D"$CXX=0A-fsanitize=3Daddress,undefined,signed-int=
eger-overflow,shift,integer-divide-by-zero=0A-fno-sanitize-recover=3Dundefi=
ned"; export CC CXX=0ACFLAGS=3D"-O0 -fno-omit-frame-pointer -ggdb"; CXXFLAG=
S=3D"-O0=0A-fno-omit-frame-pointer -ggdb"; export CFLAGS CXXFLAGS=0A=0AASAN=
_OPTIONS=3D"detect_leaks=3D0 abort_on_error=3D1 allocator_may_return_null=
=3D1";=0Aexport ASAN_OPTIONS=0A=0A=0AThe first finding is:=0A=0A=0A$ make -=
k=0A  GEN      doc/line-layout.eps=0A../src/roff/troff/dictionary.cpp:45:29=
: runtime error: left shift of=0A72057594037927936 by 8 places cannot be re=
presented in type 'ssize_t' (aka=0A'long')=0ASUMMARY: UndefinedBehaviorSani=
tizer: undefined-behavior=0A../src/roff/troff/dictionary.cpp:45:29 =0A/buil=
d/groff-1.25.0.rc1/build-64-clang/groff: error: troff: Aborted=0Amake: *** =
[Makefile:20188: doc/line-layout.eps] Error 8=0A=0A=0ASigned integer overfl=
ow is undefined behaviour.=0A=0AThe attached patch fixes it for me.=0A=0A=
=0A=0A=0A=0A=0A    _______________________________________________________=
=0AFile Attachments:=0A=0AName: ubsan-fix.diff                 Size: 1.1KiB=
=0A    <https://file.savannah.gnu.org/file/ubsan-fix.diff?file_id=3D58843>=
=0A=0A=0A=0A    AGPL NOTICE=0A=0AThese attachments are served by Savane. Yo=
u can download the corresponding=0Asource code of Savane at=0Ahttps://savan=
nah.gnu.org/source/savane-c36938be85ff6c1b727bc7dd7fd30e48f9142870.tar.gz=
=0A=0A    _______________________________________________________=0A=0ARepl=
y to this item at:=0A=0A  <https://savannah.gnu.org/bugs/?68583>=0A=0A_____=
__________________________________________=0AMessage sent via Savannah=0Aht=
tps://savannah.gnu.org/=0A
--8323329-1714636915-1785488235=:3221758
Content-Type: APPLICATION/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iHUEABYIAB0WIQQk97aszIMMAvLLwm6qLAuaBUf3TgUCamxjawAKCRCqLAuaBUf3
TmurAQDVIa+wFv9Dn3wYYuhYAj0Im3li66EBUTRDw7/m7/Oy4wEAvuLxNX2xi86Y
rrqlrrtOtLMp3iVY/HcE+28k/qja7AI=
=IPEU
-----END PGP SIGNATURE-----

--8323329-1714636915-1785488235=:3221758--