URL: <https://savannah.gnu.org/bugs/?68815>
Summary: [troff] ASAN reports heap-use-after-free in `pi`
request handler
Group: GNU roff
Submitter: gbranden
Submitted: Thu 22 Oct 2026 02:39:20 AM UTC
Category: Formatter
Severity: 4 - Important
Item Group: Incorrect behaviour
Status: In Progress
Privacy: Public
Assigned to: gbranden
Open/Closed: Open
Discussion Lock: Unlocked
Planned Release: None
_______________________________________________________
Follow-up Comments:
-------------------------------------------------------
Date: Thu 22 Oct 2026 02:39:20 AM UTC By: G. Branden Robinson <gbranden>
$ ../src/roff/groff/tests/pi-request-works.sh
checking that 'pi' request works
=================================================================
==45269==ERROR: AddressSanitizer: heap-use-after-free on address
0x611000004f00 at pc 0x7f8ae0e62298 bp 0x7ffd29616600 sp 0x7ffd29615db0
READ of size 3 at 0x611000004f00 thread T0
#0 0x7f8ae0e62297 in __interceptor_popen
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:9637
#1 0x558184832b0a in real_output_file::real_output_file()
../src/roff/troff/node.cpp:1754
#2 0x55818487b593 in troff_output_file::troff_output_file()
../src/roff/troff/node.cpp:1699
#3 0x55818487b593 in init_output() ../src/roff/troff/node.cpp:7635
#4 0x55818475d129 in top_level_diversion::begin_page(vunits)
../src/roff/troff/div.cpp:687
#5 0x5581847d810c in handle_first_page_transition()
../src/roff/troff/input.cpp:5604
#6 0x5581847c6023 in possibly_handle_first_page_transition()
../src/roff/troff/input.cpp:3576
#7 0x5581847c6023 in process_input_stack()
../src/roff/troff/input.cpp:3719
#8 0x5581847fd84e in process_input_file ../src/roff/troff/input.cpp:10072
#9 0x55818480ae0e in main ../src/roff/troff/input.cpp:10443
#10 0x7f8ae0c45249 in __libc_start_call_main
../sysdeps/nptl/libc_start_call_main.h:58
#11 0x7f8ae0c45304 in __libc_start_main_impl ../csu/libc-start.c:360
#12 0x558184745810 in _start
(/home/branden/src/GIT/groff/build/troff+0xbf810)
0x611000004f00 is located 0 bytes inside of 256-byte region
[0x611000004f00,0x611000005000)
freed by thread T0 here:
#0 0x7f8ae0eba038 in operator delete[](void*)
../../../../src/libsanitizer/asan/asan_new_delete.cpp:155
#1 0x5581847f0f7a in pipe_output ../src/roff/troff/input.cpp:9734
previously allocated by thread T0 here:
#0 0x7f8ae0eb9628 in operator new[](unsigned long)
../../../../src/libsanitizer/asan/asan_new_delete.cpp:98
#1 0x5581847ef173 in read_rest_of_line_as_argument()
../src/roff/troff/input.cpp:9667
#2 0x7ffd29616faf ([stack]+0x1efaf)
SUMMARY: AddressSanitizer: heap-use-after-free
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:9637
in __interceptor_popen
Shadow bytes around the buggy address:
0x0c227fff8990: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c227fff89a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c227fff89b0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c227fff89c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c227fff89d0: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
=>0x0c227fff89e0:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c227fff89f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c227fff8a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c227fff8a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c227fff8a20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c227fff8a30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==45269==ABORTING
_______________________________________________________
Reply to this item at:
<https://savannah.gnu.org/bugs/?68815>
_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/
signature.asc
Description: PGP signature
