gbranden pushed a commit to branch master
in repository groff.
commit 70e2df1c4b7ba2ddfe960980e8d3fbe0eb3440f3
Author: G. Branden Robinson <[email protected]>
AuthorDate: Wed Oct 21 22:15:41 2026 -0500
src/roff/troff/input.cpp: Fix Savannah #68815.
* src/roff/troff/input.cpp (pipe_output): Drop array-deletion of `pc` on
unconditional path through command (after validation checks). We
_don't_ want to delete `pc` if we have copied its value to the global
`pipe_command`, as we then risk a use-after-free (detected by GCC 12's
ASAN).
Fixes <https://savannah.gnu.org/bugs/?68815>. Problem introduced by me
in commit 8a62f58d92, 2025-02-23.
---
ChangeLog | 13 +++++++++++++
src/roff/troff/input.cpp | 1 -
2 files changed, 13 insertions(+), 1 deletion(-)
diff --git a/ChangeLog b/ChangeLog
index 655f9deac..10f1dc43b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,16 @@
+2026-10-21 G. Branden Robinson <[email protected]>
+
+ [troff]: Fix Savannah #68815.
+
+ * src/roff/troff/input.cpp (pipe_output): Drop array-deletion of
+ `pc` on unconditional path through command (after validation
+ checks). We _don't_ want to delete `pc` if we have copied its
+ value to the global `pipe_command`, as we then risk a use-after-
+ free (detected by GCC 12's ASAN).
+
+ Fixes <https://savannah.gnu.org/bugs/?68815>. Problem
+ introduced by me in commit 8a62f58d92, 2025-02-23.
+
2026-10-21 G. Branden Robinson <[email protected]>
* src/roff/groff/tests/pi-request-works.sh: Improve test. Fail
diff --git a/src/roff/troff/input.cpp b/src/roff/troff/input.cpp
index 74ef058ff..e73632e57 100644
--- a/src/roff/troff/input.cpp
+++ b/src/roff/troff/input.cpp
@@ -9731,7 +9731,6 @@ static void pipe_output() // .pi
}
else
pipe_command = pc;
- delete[] pc;
// No skip_line() here; we called read_rest_of_line_as_argument().
tok.next();
}
_______________________________________________
groff-commit mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/groff-commit
