I tried building the groff-1.25.0.rc1 with clang's ASAN.
The next finding:
GROFF doc/webpage.ps
=================================================================
==850822==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x7667d11e0291 at pc 0x639af6237a11 bp 0x7ffd0e103b90 sp 0x7ffd0e103b88
READ of size 1 at 0x7667d11e0291 thread T0
#0 0x639af6237a10 in ps_printer::do_import(char*, environment const*)
/build/groff-1.25.0.rc1/build-64-clang/../src/devices/grops/ps.cpp:1870:11
#1 0x639af6235d48 in ps_printer::special(char*, environment const*, char)
/build/groff-1.25.0.rc1/build-64-clang/../src/devices/grops/ps.cpp:1734:7
#2 0x639af6253ef4 in parse_x_command()
/build/groff-1.25.0.rc1/build-64-clang/../src/libs/libdriver/input.cpp:1530:6
#3 0x639af625725f in interpret_troff_output_file(char const*)
/build/groff-1.25.0.rc1/build-64-clang/../src/libs/libdriver/input.cpp:1827:17
#4 0x639af623a810 in main
/build/groff-1.25.0.rc1/build-64-clang/../src/devices/grops/ps.cpp:2053:5
#5 0x7a07d1e2a600 in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:59:16
#6 0x7a07d1e2a717 in __libc_start_main csu/../csu/libc-start.c:360:3
#7 0x639af612ce34 in _start
(/build/groff-1.25.0.rc1/build-64-clang/grops+0x85e34)
0x7667d11e0291 is located 0 bytes after 49-byte region
[0x7667d11e0260,0x7667d11e0291)
allocated by thread T0 here:
#0 0x639af62154fd in operator new[](unsigned long)
/home/runner/work/llvm-project/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:111:37
#1 0x639af624eb10 in StringBuf::make_string()
/build/groff-1.25.0.rc1/build-64-clang/../src/libs/libdriver/input.cpp:568:18
#2 0x639af625072c in get_extended_arg()
/build/groff-1.25.0.rc1/build-64-clang/../src/libs/libdriver/input.cpp:773:14
#3 0x639af6253d26 in parse_x_command()
/build/groff-1.25.0.rc1/build-64-clang/../src/libs/libdriver/input.cpp:1523:23
#4 0x639af625725f in interpret_troff_output_file(char const*)
/build/groff-1.25.0.rc1/build-64-clang/../src/libs/libdriver/input.cpp:1827:17
#5 0x639af623a810 in main
/build/groff-1.25.0.rc1/build-64-clang/../src/devices/grops/ps.cpp:2053:5
#6 0x7a07d1e2a600 in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:59:16
#7 0x7a07d1e2a717 in __libc_start_main csu/../csu/libc-start.c:360:3
#8 0x639af612ce34 in _start
(/build/groff-1.25.0.rc1/build-64-clang/grops+0x85e34)
SUMMARY: AddressSanitizer: heap-buffer-overflow
/build/groff-1.25.0.rc1/build-64-clang/../src/devices/grops/ps.cpp:1870:11 in
ps_printer::do_import(char*, environment const*)
Shadow bytes around the buggy address:
0x7667d11e0000: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa
0x7667d11e0080: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00
0x7667d11e0100: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00
0x7667d11e0180: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa
0x7667d11e0200: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00
=>0x7667d11e0280: 00 00[01]fa fa fa fa fa fa fa fa fa fa fa fa fa
0x7667d11e0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x7667d11e0380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x7667d11e0400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x7667d11e0480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x7667d11e0500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==850822==ABORTING
/build/groff-1.25.0.rc1/build-64-clang/groff: error: grops: Aborted
make[2]: *** [Makefile:19776: doc/webpage.ps] Error 8
"READ of size 1" with "is located 0 bytes after 49-byte region" obviously
means that the memory block should have been 50 bytes large, not 49.
Bruno
