URL:
  <https://savannah.gnu.org/bugs/?68583>

                 Summary: [PATCH] [troff] signed integer overflow in
dictionary.cpp:is_good_size()
                   Group: GNU roff
               Submitter: gbranden
               Submitted: Fri 31 Jul 2026 08:57:11 AM UTC
                Category: Core
                Severity: 3 - Normal
              Item Group: Incorrect behaviour
                  Status: In Progress
                 Privacy: Public
             Assigned to: gbranden
             Open/Closed: Open
         Discussion Lock: Unlocked
         Planned Release: None


    _______________________________________________________

Follow-up Comments:


-------------------------------------------------------
Date: Fri 31 Jul 2026 08:57:11 AM UTC By: G. Branden Robinson <gbranden>
[https://lists.gnu.org/archive/html/groff/2026-07/msg00052.html Bruno reported
to the _groff_ list]:

I tried building the groff-1.25.0.rc1 with clang's ASAN (usually better than
gcc's ASAN) on a GNU system. For reference, I use these environment
variables:


CC="$HOME/inst-clang/22.1.0/bin/clang -Wl,-rpath,$HOME/inst-clang/22.1.0/lib
-Wl,-rpath,$HOME/inst-clang/22.1.0/lib/x86_64-unknown-linux-gnu"
CXX="$HOME/inst-clang/22.1.0/bin/clang++ -I/usr/include/c++/14
-I/usr/include/x86_64-linux-gnu/c++/11 -L/usr/lib/gcc/x86_64-linux-gnu/14
-Wl,-rpath,$HOME/inst-clang/22.1.0/lib
-Wl,-rpath,$HOME/inst-clang/22.1.0/lib/x86_64-unknown-linux-gnu"

CC="$CC
-fsanitize=address,undefined,signed-integer-overflow,shift,integer-divide-by-zero
-fno-sanitize-recover=undefined"; CXX="$CXX
-fsanitize=address,undefined,signed-integer-overflow,shift,integer-divide-by-zero
-fno-sanitize-recover=undefined"; export CC CXX
CFLAGS="-O0 -fno-omit-frame-pointer -ggdb"; CXXFLAGS="-O0
-fno-omit-frame-pointer -ggdb"; export CFLAGS CXXFLAGS

ASAN_OPTIONS="detect_leaks=0 abort_on_error=1 allocator_may_return_null=1";
export ASAN_OPTIONS


The first finding is:


$ make -k
  GEN      doc/line-layout.eps
../src/roff/troff/dictionary.cpp:45:29: runtime error: left shift of
72057594037927936 by 8 places cannot be represented in type 'ssize_t' (aka
'long')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
../src/roff/troff/dictionary.cpp:45:29 
/build/groff-1.25.0.rc1/build-64-clang/groff: error: troff: Aborted
make: *** [Makefile:20188: doc/line-layout.eps] Error 8


Signed integer overflow is undefined behaviour.

The attached patch fixes it for me.






    _______________________________________________________
File Attachments:

Name: ubsan-fix.diff                 Size: 1.1KiB
    <https://file.savannah.gnu.org/file/ubsan-fix.diff?file_id=58843>



    AGPL NOTICE

These attachments are served by Savane. You can download the corresponding
source code of Savane at
https://savannah.gnu.org/source/savane-c36938be85ff6c1b727bc7dd7fd30e48f9142870.tar.gz

    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?68583>

_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/

Attachment: signature.asc
Description: PGP signature

Reply via email to