gbranden pushed a commit to branch master
in repository groff.
commit 8ef98cfb067b249e7a34568062027e0ccdba7b1f
Author: Bruno Haible <[email protected]>
AuthorDate: Sun Aug 2 13:54:32 2026 +0200
tbl: Fix undefined behaviour.
This change fixes ASAN findings such as:
ERROR: AddressSanitizer: alloc-dealloc-mismatch (malloc vs operator delete
[]) on 0x6f5aaafeb4e0
#0 0x5a98c9ab586d in operator delete[](void*)
/home/runner/work/llvm-project/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:179:46
#1 0x5a98c9ad6eaf in block_entry::~block_entry()
/devel/groff/src/preproc/tbl/table.cpp:667:3
#2 0x5a98c9b0cad4 in left_block_entry::~left_block_entry()
/devel/groff/src/preproc/tbl/table.cpp:334:7
#3 0x5a98c9b0cb24 in left_block_entry::~left_block_entry()
/devel/groff/src/preproc/tbl/table.cpp:334:7
#4 0x5a98c9ae6f36 in table::~table()
/devel/groff/src/preproc/tbl/table.cpp:1310:5
#5 0x5a98c9ab89fc in process_table(table_input&)
/devel/groff/src/preproc/tbl/main.cpp:1677:5
#6 0x5a98c9ab7da7 in process_input_file(_IO_FILE*)
/devel/groff/src/preproc/tbl/main.cpp:270:4
#7 0x5a98c9acdc9e in main /devel/groff/src/preproc/tbl/main.cpp:1792:5
0x6f5aaafeb4e0 is located 0 bytes inside of 62-byte region
[0x6f5aaafeb4e0,0x6f5aaafeb51e)
allocated by thread T0 here:
#0 0x5a98c9a71f39 in calloc
/home/runner/work/llvm-project/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:74:3
#1 0x5a98c9b15f2a in string::extract() const
/devel/groff/src/libs/libgroff/string.cpp:384:33
#2 0x5a98c9aed448 in table::add_entry(int, int, string const&,
entry_format const*, char const*, int)
/devel/groff/src/preproc/tbl/table.cpp:1546:17
#3 0x5a98c9acabf6 in process_data(table_input&, format*, options*)
/devel/groff/src/preproc/tbl/main.cpp:1577:13
#4 0x5a98c9ab8972 in process_table(table_input&)
/devel/groff/src/preproc/tbl/main.cpp:1675:17
#5 0x5a98c9ab7da7 in process_input_file(_IO_FILE*)
/devel/groff/src/preproc/tbl/main.cpp:270:4
#6 0x5a98c9acdc9e in main /devel/groff/src/preproc/tbl/main.cpp:1792:5
SUMMARY: AddressSanitizer: alloc-dealloc-mismatch
/devel/groff/src/preproc/tbl/table.cpp:667:3 in block_entry::~block_entry()
* src/preproc/tbl/table.cpp (block_entry::~block_entry): Free the contents
field using free(), not delete[].
---
src/preproc/tbl/table.cpp | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/src/preproc/tbl/table.cpp b/src/preproc/tbl/table.cpp
index bd0abcda6..392b41ad3 100644
--- a/src/preproc/tbl/table.cpp
+++ b/src/preproc/tbl/table.cpp
@@ -214,7 +214,7 @@ public:
class text_entry : public simple_entry {
protected:
- char *contents;
+ char *contents; // to be freed with free()
void print_contents();
public:
text_entry(const table *, const entry_modifier *, char *);
@@ -319,7 +319,7 @@ public:
};
class block_entry : public table_entry {
- char *contents;
+ char *contents; // to be freed with free()
protected:
void do_divert(int, int, const string *, int *, int);
public:
@@ -664,7 +664,7 @@ block_entry::block_entry(const table *p, const
entry_modifier *m,
block_entry::~block_entry()
{
- delete[] contents;
+ free(contents);
}
void block_entry::position_vertically()
_______________________________________________
groff-commit mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/groff-commit
