Hello, I found 5 defect(s) in groff. Each has a minimal PoC, a reproduction command and a proposed patch.
1. NULL pointer dereference in the file-iterator path (strdup result used before the NULL check) CWE-476 — Low (DoS) | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (5.5 Medium) troff builds a file_iterator whose name can be NULL; strdup(fn) is used before the NULL check on the following line, so a crafted document dereferences address 0. 2. Assertion failure (abort) in lookup_request on a missing identifier CWE-617 — Low (DoS) | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (5.5 Medium) A crafted man page drives request lookup into a state where the identifier is null, hitting an assertion instead of a diagnostic. 3. Global buffer overflow (write) from a capacity mismatch in describe_node CWE-787 — Medium (out-of-bounds write) | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8 High) A 55-byte static buffer is passed to describe_node() with the caller buffer size (62), so memset() and snprintf() write past its end. 4. Assertion failure (abort) while parsing line-drawing escapes CWE-617 — Low (DoS) | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (5.5 Medium) read_line_rule_expression() assumes the token produced by a line-drawing escape carries charinfo; a crafted sequence violates it and aborts. 5. Missing-identifier paths use assertions instead of error handling (four sites, one root cause) CWE-617 — Low (DoS) | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (5.5 Medium) Four code paths assume an identifier is non-null and assert otherwise; crafted input reaches all four. PoC files, harness sources and patches are in the attached archive, one directory per item. On the CVE side: no CNA covers these projects upstream, so the ID would come from MITRE (CNA of last resort). MITRE's preferred route is for the upstream project to submit the request; if you would rather do that I can hand you the completed request fields ready to paste. Otherwise I will file with MITRE myself once we agree the defects are real. No CVE ID has been assigned yet. Regards, hjh_nju
groff-reports.tar.gz
Description: application/gzip
