Hi, I found a crash in colcrt, (filter nroff output for CRT previewing) . - The colcrt command is part of the util-linux package and is available from Linux Kernel Archive http://man7.org/linux/man-pages/man1/colcrt.1.html https://www.kernel.org/pub/linux/utils/util-linux/v2.27/
*Details:* platform: Linux x86/x64 Version: colcrt from util-linux-2.27 colcrt from util-linux-2.27 and below crashed by the use of colcrt command line. the crash caused in colcrt. when running colcrt with the following file (attached), it crashes because i believe when colcrt.c:213 is called in colcrt.c, c returned it will dereferencing pointer "cp" because "cp = &page[outline][outcol];" at line 205 where "cp" may point to element beyond "page" as buffer overrun. here is the backtrace from gdb: -bash-4.2$ gdb /opt/linuxtools/bin/colcrt GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-51.el7 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html > This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /opt/linuxtools/bin/colcrt...done. (gdb) r file Starting program: /opt/linuxtools/bin/colcrt file *Program received signal SIGSEGV, Segmentation fault.* *216 cp[i] = c;* colcrt (f=0x62b060) at text-utils/colcrt.c:216 Missing separate debuginfos, use: debuginfo-install glibc-2.17-55.el7_0.5.x86_64 (gdb) bt full #0 colcrt (f=0x62b060) at text-utils/colcrt.c:216 c = <optimized out> cp = 0x606fe8 L"" dp = <optimized out> i = 0 w = 1 #1 0x00000000004015bc in main (argc=0, argv=0x7fffffffe5f8) at text-utils/colcrt.c:139 f = 0x62b060 i = <optimized out> opt = <optimized out> longopts = {{name = 0x405d67 "no-underlining", has_arg = 0, flag = 0x0, val = 128}, {name = 0x405d76 "half-lines", has_arg = 0, flag = 0x0, val = 50}, { name = 0x405d81 "version", has_arg = 0, flag = 0x0, val = 86}, {name = 0x405d89 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}} Thanks Ala'a
file
Description: Binary data
