gbranden pushed a commit to branch master
in repository groff.
commit e662fa0f31c77891239c0955ae5c6922c42e1176
Author: G. Branden Robinson <[email protected]>
AuthorDate: Thu Sep 10 03:20:37 2026 -0500
[libbib]: Fix Savannah #68679.
* src/libs/libbib/index.cpp (index_search_item::check_header): Check
more header data for nonsense, as they can influence the size of
memory allocations. Invalidate index file if its maximum or minimum
key lengths, or common word list length threshold is nonpositive.
Fixes <https://savannah.gnu.org/bugs/?68679>. Thanks to Pavol Sloboda
for the report. Problem dates back to groff's birth. (And I didn't
catch it when doing the work for commit 1b97881fc0, 2021-09-12.)
ANNOUNCE: Acknowledge Pavol Sloboda.
---
ANNOUNCE | 1 +
ChangeLog | 13 +++++++++++++
src/libs/libbib/index.cpp | 6 ++++++
3 files changed, 20 insertions(+)
diff --git a/ANNOUNCE b/ANNOUNCE
index 7e9e751bb..afbf0c390 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -239,6 +239,7 @@ Luis Rivera
Martin Simmons
Morten Bo Johansen
Nguyễn Gia Phong
+Pavol Sloboda
Pádraig Brady
Richard Purdie
Ross Burton
diff --git a/ChangeLog b/ChangeLog
index bea24debb..a88eb50e3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,16 @@
+2026-09-10 G. Branden Robinson <[email protected]>
+
+ * src/libs/libbib/index.cpp (index_search_item::check_header):
+ Check more header data for nonsense, as they can influence the
+ size of memory allocations. Invalidate index file if its
+ maximum or minimum key lengths, or common word list length
+ threshold is nonpositive.
+
+ Fixes <https://savannah.gnu.org/bugs/?68679>. Thanks to Pavol
+ Sloboda for the report. Problem dates back to groff's birth.
+ {And I didn't catch it when doing the work for commit
+ 1b97881fc0, 2021-09-12.}
+
2026-09-10 G. Branden Robinson <[email protected]>
[refer]: Regression-test Savannah #68679.
diff --git a/src/libs/libbib/index.cpp b/src/libs/libbib/index.cpp
index b783ebf1e..3ae702c98 100644
--- a/src/libs/libbib/index.cpp
+++ b/src/libs/libbib/index.cpp
@@ -167,6 +167,12 @@ const char *index_search_item::check_header(index_header
*file_header,
return "table size nonpositive";
if (file_header->strings_size < 1)
return "string pool size nonpositive";
+ if (file_header->truncate < 1)
+ return "maximum key length nonpositive";
+ if (file_header->shortest < 1)
+ return "minimum key length nonpositive";
+ if (file_header->common < 1)
+ return "common word list length threshold nonpositive";
size_t sz = (file_header->tags_size * sizeof(tag)
+ file_header->lists_size * sizeof(int)
+ file_header->table_size * sizeof(int)
_______________________________________________
groff-commit mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/groff-commit
