gbranden pushed a commit to branch master
in repository groff.
commit 0f74adb4190f25238b7c1f49462added35471363
Author: Bruno Haible <[email protected]>
AuthorDate: Sun Aug 2 13:54:38 2026 +0200
eqn: Fix undefined behaviour, part 1.
This change fixes this ASAN finding:
ERROR: AddressSanitizer: alloc-dealloc-mismatch (malloc vs operator delete
[]) on 0x6d5acafe9730
#0 0x582e73588e9d in operator delete[](void*)
/home/runner/work/llvm-project/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:179:46
#1 0x582e735d26af in delim_box::~delim_box()
/devel/groff/src/preproc/eqn/delim.cpp:205:3
#2 0x582e735d27f4 in delim_box::~delim_box()
/devel/groff/src/preproc/eqn/delim.cpp:204:1
#3 0x582e735a2949 in box_list::~box_list()
/devel/groff/src/preproc/eqn/box.cpp:524:5
#4 0x582e735b15f0 in list_box::~list_box()
/devel/groff/src/preproc/eqn/box.h:69:7
#5 0x582e735b1644 in list_box::~list_box()
/devel/groff/src/preproc/eqn/box.h:69:7
#6 0x582e735a1768 in box::top_level()
/devel/groff/src/preproc/eqn/box.cpp:415:3
#7 0x582e735e4502 in yyparse()
/devel/groff/src/preproc/eqn/eqn.ypp:132:33
#8 0x582e7358d33d in do_file(_IO_FILE*, char const*)
/devel/groff/src/preproc/eqn/main.cpp:155:7
#9 0x582e7358b338 in main /devel/groff/src/preproc/eqn/main.cpp:483:5
0x6d5acafe9730 is located 0 bytes inside of 2-byte region
[0x6d5acafe9730,0x6d5acafe9732)
allocated by thread T0 here:
#0 0x582e73545394 in malloc
/home/runner/work/llvm-project/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3
#1 0x582e735fd4b7 in strsave(char const*)
/devel/groff/src/libs/libgroff/strsave.cpp:36:33
#2 0x582e735eb13c in yyparse()
/devel/groff/src/preproc/eqn/eqn.ypp:332:33
#3 0x582e7358d33d in do_file(_IO_FILE*, char const*)
/devel/groff/src/preproc/eqn/main.cpp:155:7
#4 0x582e7358b338 in main /devel/groff/src/preproc/eqn/main.cpp:483:5
SUMMARY: AddressSanitizer: alloc-dealloc-mismatch
/devel/groff/src/preproc/eqn/delim.cpp:205:3 in delim_box::~delim_box()
* src/preproc/eqn/delim.cpp (delim_box::~delim_box): Free the left and right
fields using free(), not delete[].
* src/preproc/eqn/special.cpp (special_box::~special_box): Free the
macro_name
field using free(), not delete[].
---
src/preproc/eqn/delim.cpp | 4 ++--
src/preproc/eqn/eqn.ypp | 2 +-
src/preproc/eqn/special.cpp | 2 +-
3 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/preproc/eqn/delim.cpp b/src/preproc/eqn/delim.cpp
index c3765f9d4..2dc1d01e4 100644
--- a/src/preproc/eqn/delim.cpp
+++ b/src/preproc/eqn/delim.cpp
@@ -202,8 +202,8 @@ delim_box::delim_box(char *l, box *pp, char *r)
delim_box::~delim_box()
{
- delete[] left;
- delete[] right;
+ free(left);
+ free(right);
delete p;
}
diff --git a/src/preproc/eqn/eqn.ypp b/src/preproc/eqn/eqn.ypp
index 4251bb49b..d14cf6b43 100644
--- a/src/preproc/eqn/eqn.ypp
+++ b/src/preproc/eqn/eqn.ypp
@@ -34,7 +34,7 @@ void yyerror(const char *);
%}
%union {
- char *str;
+ char *str; // to be freed with free()
box *b;
pile_box *pb;
matrix_box *mb;
diff --git a/src/preproc/eqn/special.cpp b/src/preproc/eqn/special.cpp
index 97a23e08e..35c3c08f6 100644
--- a/src/preproc/eqn/special.cpp
+++ b/src/preproc/eqn/special.cpp
@@ -68,7 +68,7 @@ special_box::special_box(char *s, box *pp) : pointer_box(pp),
macro_name(s)
special_box::~special_box()
{
- delete[] macro_name;
+ free(macro_name);
}
int special_box::compute_metrics(int style)
_______________________________________________
groff-commit mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/groff-commit
