gbranden pushed a commit to branch master
in repository groff.
commit 5b228fbfc8ad4878f9795fa8f855bd354279e903
Author: G. Branden Robinson <[email protected]>
AuthorDate: Thu Sep 10 06:46:18 2026 -0500
[libbib]: Fix Savannah #68681.
* src/libs/libbib/index.cpp (index_search_item::load): Check index file
contents for nonsense: a string pool that begins with a null byte. If
it does, throw error diagnostic and return `false`, ignoring the index
file and falling back to the plain text bibliographic database. This
prevents us from overreading the memory-mapped index file by one byte
in the event it was truncated right after that null byte (due to
nested use of strchr(3) and pointer arithmetic).
Fixes <https://savannah.gnu.org/bugs/?68681>. Thanks to Pavol Sloboda
for the report and analysis. Problem dates back to groff's birth. (And
I didn't catch it when doing the work for commit 1b97881fc0,
2021-09-12.)
---
ChangeLog | 16 ++++++++++++++++
src/libs/libbib/index.cpp | 4 ++++
2 files changed, 20 insertions(+)
diff --git a/ChangeLog b/ChangeLog
index 691707129..db91f299c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,19 @@
+2026-09-10 G. Branden Robinson <[email protected]>
+
+ * src/libs/libbib/index.cpp (index_search_item::load): Check
+ index file contents for nonsense: a string pool that begins with
+ a null byte. If it does, throw error diagnostic and return
+ `false`, ignoring the index file and falling back to the plain
+ text bibliographic database. This prevents us from overreading
+ the memory-mapped index file by one byte in the event it was
+ truncated right after that null byte (due to nested use of
+ strchr(3) and pointer arithmetic).
+
+ Fixes <https://savannah.gnu.org/bugs/?68681>. Thanks to Pavol
+ Sloboda for the report and analysis. Problem dates back to
+ groff's birth. {And I didn't catch it when doing the work for
+ commit 1b97881fc0, 2021-09-12.}
+
2026-09-11 G. Branden Robinson <[email protected]>
[refer]: Regression-test Savannah #68681.
diff --git a/src/libs/libbib/index.cpp b/src/libs/libbib/index.cpp
index 3ae702c98..a142a7083 100644
--- a/src/libs/libbib/index.cpp
+++ b/src/libs/libbib/index.cpp
@@ -269,6 +269,10 @@ bool index_search_item::load(int fd)
lists = (int *)(tags + header.tags_size);
table = (int *)(lists + header.lists_size);
pool = (char *)(table + header.table_size);
+ if ('\0' == *pool) {
+ error("ignoring index file '%1' due to corrupt string pool", name);
+ return false;
+ }
ignore_fields = strchr(strchr(pool, '\0') + 1, '\0') + 1;
key_buffer = new char[header.truncate];
read_common_words_file();
_______________________________________________
groff-commit mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/groff-commit
