gbranden pushed a commit to branch master
in repository groff.
commit 0f9635654f74897052f979700f35aa5d853f72ee
Author: G. Branden Robinson <[email protected]>
AuthorDate: Thu Sep 17 20:12:48 2026 -0500
[libbib]: Fix Savannah #68682 (1/2).
* src/libs/libbib/index.cpp (index_search_item::get_invalidity_reason):
Check index of file name for nonsense (nonpositive) value, and reject
it if has one. This prevents us from an out-of-bounds read of the
(memory-mapped) index file.
Fixes <https://savannah.gnu.org/bugs/?68682> (1/2). Thanks to Pavol
Sloboda for the report and analysis. Problem dates back to groff's
birth. (And I didn't catch it when doing the work for commit
1b97881fc0, 2021-09-12.)
Test still fails at this commit.
---
ChangeLog | 13 +++++++++++++
src/libs/libbib/index.cpp | 2 ++
2 files changed, 15 insertions(+)
diff --git a/ChangeLog b/ChangeLog
index 79d2676d9..6258f0ad0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,16 @@
+2026-09-17 G. Branden Robinson <[email protected]>
+
+ * src/libs/libbib/index.cpp
+ (index_search_item::get_invalidity_reason): Check index of file
+ name for nonsense (nonpositive) value, and reject it if has one.
+ This prevents us from an out-of-bounds read of the
+ {memory-mapped} index file.
+
+ Fixes <https://savannah.gnu.org/bugs/?68682> (1/2). Thanks to
+ Pavol Sloboda for the report and analysis. Problem dates back
+ to groff's birth. {And I didn't catch it when doing the work
+ for commit 1b97881fc0, 2021-09-12.}
+
2026-09-17 G. Branden Robinson <[email protected]>
[refer]: Regression-test Savannah #68682.
diff --git a/src/libs/libbib/index.cpp b/src/libs/libbib/index.cpp
index 1bff575a5..e9d4d9e84 100644
--- a/src/libs/libbib/index.cpp
+++ b/src/libs/libbib/index.cpp
@@ -300,6 +300,8 @@ const char *index_search_item::get_invalidity_reason()
}
}
for (i = 0; i < header.tags_size; i++) {
+ if (tags[i].filename_index <= 0)
+ return "invalid (nonpositive) file name index in tags";
if (tags[i].filename_index >= header.strings_size)
return "bad index in tags";
if (tags[i].length < 0)
_______________________________________________
groff-commit mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/groff-commit
