gbranden pushed a commit to branch master
in repository groff.
commit 85f79ee8f39d906172af553a0601cf130cdb450b
Author: G. Branden Robinson <[email protected]>
AuthorDate: Thu Sep 17 21:06:42 2026 -0500
[libbib]: Fix Savannah #68685.
* src/libs/libbib/index.cpp
(index_search_item_iterator::index_search_item_iterator): Avoid
excessive memory allocation arising from corrupt index file, rousing
the wrath of the Linux OOM process killer or similar. Check index
file's claimed length of common word list for an implausibly large
value. Pick 10,000, which I'm sure is still a pretty implausible size
of a list of _common_ words to any linguist.
Fixes <https://savannah.gnu.org/bugs/?68685>. Thanks to Pavol Sloboda
for the report and analysis. Problem dates back to groff's birth.
---
ChangeLog | 15 +++++++++++++++
src/libs/libbib/index.cpp | 8 ++++++--
2 files changed, 21 insertions(+), 2 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index a62138782..c2f5dd86a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,18 @@
+2026-09-17 G. Branden Robinson <[email protected]>
+
+ * src/libs/libbib/index.cpp
+ (index_search_item_iterator::index_search_item_iterator): Avoid
+ excessive memory allocation arising from corrupt index file,
+ rousing the wrath of the Linux OOM process killer or similar.
+ Check index file's claimed length of common word list for an
+ implausibly large value. Pick 10,000, which I'm sure is still a
+ pretty implausible size of a list of _common_ words to any
+ linguist.
+
+ Fixes <https://savannah.gnu.org/bugs/?68685>. Thanks to
+ Pavol Sloboda for the report and analysis. Problem dates back
+ to groff's birth.
+
2026-09-17 G. Branden Robinson <[email protected]>
[refer]: Regression-test Savannah #68685.
diff --git a/src/libs/libbib/index.cpp b/src/libs/libbib/index.cpp
index a53da8e68..1d6317f66 100644
--- a/src/libs/libbib/index.cpp
+++ b/src/libs/libbib/index.cpp
@@ -629,9 +629,13 @@ const int *index_search_item::search(const char *ptr, int
length,
void index_search_item::read_common_words_file()
{
- if (header.common <= 0)
- return;
const char *common_words_file = munge_filename(strchr(pool, '\0') + 1);
+ if ((header.common <= 0) || (header.common >= 10000)) {
+ error("implausible count of common words %1 reported in index file"
+ " '%2'; treating no words as common", header.common,
+ common_words_file);
+ return;
+ }
errno = 0;
FILE *fp = fopen(common_words_file, "r");
if (!fp) {
_______________________________________________
groff-commit mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/groff-commit
