Update of bug #64892 (group groff):
Severity: 2 - Minor => 3 - Normal
Status: Need Info => Fixed
Assigned to: None => gbranden
Open/Closed: Open => Closed
Planned Release: None => 1.25.0
_______________________________________________________
Follow-up Comment #4:
I believe Bruno Haible fixed this problem in August. At his prompting, we
seem to have made this variety of memory safety a release goal after the RC
part of the cycle already started...!
commit 8ef98cfb067b249e7a34568062027e0ccdba7b1f
Author: Bruno Haible <[email protected]>
Date: Sun Aug 2 13:54:32 2026 +0200
tbl: Fix undefined behaviour.
This change fixes ASAN findings such as:
ERROR: AddressSanitizer: alloc-dealloc-mismatch (malloc vs operator delete
[]) on 0x6f5aaafeb4e0
#0 0x5a98c9ab586d in operator delete[](void*)
/home/runner/work/llvm-project/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:179:46
#1 0x5a98c9ad6eaf in block_entry::~block_entry()
/devel/groff/src/preproc/tbl/table.cpp:667:3
#2 0x5a98c9b0cad4 in left_block_entry::~left_block_entry()
/devel/groff/src/preproc/tbl/table.cpp:334:7
#3 0x5a98c9b0cb24 in left_block_entry::~left_block_entry()
/devel/groff/src/preproc/tbl/table.cpp:334:7
#4 0x5a98c9ae6f36 in table::~table()
/devel/groff/src/preproc/tbl/table.cpp:1310:5
#5 0x5a98c9ab89fc in process_table(table_input&)
/devel/groff/src/preproc/tbl/main.cpp:1677:5
#6 0x5a98c9ab7da7 in process_input_file(_IO_FILE*)
/devel/groff/src/preproc/tbl/main.cpp:270:4
#7 0x5a98c9acdc9e in main
/devel/groff/src/preproc/tbl/main.cpp:1792:5
0x6f5aaafeb4e0 is located 0 bytes inside of 62-byte region
[0x6f5aaafeb4e0,0x6f5aaafeb51e)
allocated by thread T0 here:
#0 0x5a98c9a71f39 in calloc
/home/runner/work/llvm-project/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:74:3
#1 0x5a98c9b15f2a in string::extract() const
/devel/groff/src/libs/libgroff/string.cpp:384:33
#2 0x5a98c9aed448 in table::add_entry(int, int, string const&,
entry_format const*, char const*, int)
/devel/groff/src/preproc/tbl/table.cpp:1546:17
#3 0x5a98c9acabf6 in process_data(table_input&, format*, options*)
/devel/groff/src/preproc/tbl/main.cpp:1577:13
#4 0x5a98c9ab8972 in process_table(table_input&)
/devel/groff/src/preproc/tbl/main.cpp:1675:17
#5 0x5a98c9ab7da7 in process_input_file(_IO_FILE*)
/devel/groff/src/preproc/tbl/main.cpp:270:4
#6 0x5a98c9acdc9e in main
/devel/groff/src/preproc/tbl/main.cpp:1792:5
SUMMARY: AddressSanitizer: alloc-dealloc-mismatch
/devel/groff/src/preproc/tbl/table.cpp:667:3 in block_entry::~block_entry()
* src/preproc/tbl/table.cpp (block_entry::~block_entry): Free the
contents
field using free(), not delete[].
_______________________________________________________
Reply to this item at:
<https://savannah.gnu.org/bugs/?64892>
_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/
signature.asc
Description: PGP signature
