URL: <https://savannah.gnu.org/bugs/?68783>
Summary: [troff] SEGV when empty string interpolation given
as argument to `so` request
Group: GNU roff
Submitter: gbranden
Submitted: Fri 16 Oct 2026 03:06:44 PM UTC
Category: Formatter
Severity: 4 - Important
Item Group: Crash/Unresponsive
Status: Confirmed
Privacy: Public
Assigned to: gbranden
Open/Closed: Open
Discussion Lock: Unlocked
Planned Release: None
_______________________________________________________
Follow-up Comments:
-------------------------------------------------------
Date: Fri 16 Oct 2026 03:06:44 PM UTC By: G. Branden Robinson <gbranden>
Problem reported against the `soquiet` request using a seeming randomly fuzzed
input based on specimen(s) from _contrib/hdtbl_.
Date: Fri, 16 Oct 2026 21:36:33 +0800
From: DDT Cr <[email protected]>
To: [email protected]
Message-ID:
<CAODORKgJKyecTxc0Unib=cekd5zuwnqhr5ea4hp1e+spzow...@mail.gmail.com>
Subject: groff: 5 memory-safety defect(s) — reports, PoCs and patches
attached
[-- Attachment #1 --]
[-- Type: multipart/alternative, Encoding: 7bit, Size: 5.1K --]
Hello,
I found 5 defect(s) in groff. Each has a minimal PoC, a reproduction
command and a proposed patch.
1. NULL pointer dereference in the file-iterator path (strdup result used
before the NULL check)
CWE-476 — Low (DoS) | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (5.5
Medium)
troff builds a file_iterator whose name can be NULL; strdup(fn) is used
before the NULL check on the following line, so a crafted document
dereferences address 0.
The POC was far larger than it needed to be.
$ ls -hl poc*
-rw-r--r-- 1 branden branden 2.9K Oct 6 12:54 poc.roff
-rw-r--r-- 1 branden branden 8 Oct 16 09:47 poc2-gbr.roff
Here's a simpler reproducer.
$ echo '.so \*a' | troff
Segmentation fault (core dumped)
Reproduced with Git HEAD, 1.24.2, 1.24.1, and 1.24.0, but not 1.23.0, 1.22.4,
nor 1.22.3.
Target this fix for 1.25.0.
Check for duplicated and/or incorrectly factored logic--this problem affects
`so` _and_ `soquiet`, so confirm that any fix also renders `mso`, `msoquiet`,
and `pso` immune to this crash.
_______________________________________________________
File Attachments:
Name: ddtcr800-1.tar Size: 20KiB
<https://file.savannah.gnu.org/file/ddtcr800-1.tar?file_id=59103>
AGPL NOTICE
These attachments are served by Savane. You can download the corresponding
source code of Savane at
https://savannah.gnu.org/source/savane-008698919f826f0fb06bcafffba4902404c2a7d0.tar.gz
_______________________________________________________
Reply to this item at:
<https://savannah.gnu.org/bugs/?68783>
_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/
signature.asc
Description: PGP signature
