Update of bug #68815 (group groff):
Planned Release: None => 1.25.0
Summary: [troff] ASAN reports heap-use-after-free in `pi`
request handler => [PATCH] [troff] ASAN reports heap-use-after-free in `pi`
request handler
_______________________________________________________
Follow-up Comment #1:
diff --git a/ChangeLog b/ChangeLog
index 655f9deac..8147df422 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,16 @@
+2026-10-21 G. Branden Robinson <[email protected]>
+
+ [troff]: Fix Savannah #68815.
+
+ * src/roff/troff/input.cpp (pipe_output): Drop array-deletion of
+ `pc` on unconditional path through command (after validation
+ checks). We _don't_ want to delete `pc` if we have copied its
+ value to the global `pipe_command`, as we then risk a use-after-
+ free (detected by GCC 12's ASAN).
+
+ Fixes <https://savannah.gnu.org/bugs/?68815>. Problem
+ introduced by me in 8a62f58d92, 2025-02-23.
+
2026-10-21 G. Branden Robinson <[email protected]>
* src/roff/groff/tests/pi-request-works.sh: Improve test. Fail
diff --git a/src/roff/troff/input.cpp b/src/roff/troff/input.cpp
index 74ef058ff..e73632e57 100644
--- a/src/roff/troff/input.cpp
+++ b/src/roff/troff/input.cpp
@@ -9731,7 +9731,6 @@ static void pipe_output() // .pi
}
else
pipe_command = pc;
- delete[] pc;
// No skip_line() here; we called read_rest_of_line_as_argument().
tok.next();
}
_______________________________________________________
Reply to this item at:
<https://savannah.gnu.org/bugs/?68815>
_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/
signature.asc
Description: PGP signature
