[Groff] address@hidden: groff 1.18.1 memory allocation bugs]

[Bernd Warken]

----- Forwarded message from Ivan Popov <address@hidden> -----

Delivered-To: address@hidden
X-Authentication-Warning: hotlips.cs.chalmers.se: pin owned process doing -bs
Date: Sun, 30 Mar 2003 03:00:52 +0200 (MET DST)
From: Ivan Popov <address@hidden>
To: <address@hidden>
Subject: groff 1.18.1 memory allocation bugs
X-BeenThere: address@hidden
X-Mailman-Version: 2.1b5
Precedence: list
List-Id: Bug reports for the GNU version of nroff, troff et al
        <bug-groff.gnu.org>
List-Help: <mailto:address@hidden>
List-Post: <mailto:address@hidden>
List-Subscribe: <http://mail.gnu.org/mailman/listinfo/bug-groff>,
        <mailto:address@hidden>
List-Archive: <http://mail.gnu.org/pipermail/bug-groff>
List-Unsubscribe: <http://mail.gnu.org/mailman/listinfo/bug-groff>,
        <mailto:address@hidden>
Errors-To: address@hidden

Hello,

I have identified a couple of places in groff where it is doing
wrong things with memory allocation.

There are probably more places there, but I can't spend more time on
reading the source, neither am I good at C++.

I attach the patch that enables me compile and use groff with
gcc 3.2.2 and corresponding libstdc++. Without the patch groff and
pre-grohtml segfault. With the patch they do not segfault at once at
least.

The patch is not "right", but it can show the problem and a
possible fix. In new.cc one should redefine either both
new and delete, or none of them, imho. I do not know how to do it right.
Likewise usage of malloc() and then delete on the same object is
unacceptable.

Best regards,
--
Ivan

--- src/libs/libgroff/new.cc.ori        2003-03-29 23:49:34.000000000 +0100
+++ src/libs/libgroff/new.cc    2003-03-29 23:50:40.000000000 +0100
@@ -17,6 +17,8 @@
 with groff; see the file COPYING.  If not, write to the Free Software
 Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. */
 
+#if 0 /* pin */
+
 #include "lib.h"
 
 #include <stddef.h>
@@ -67,3 +69,5 @@
 }
 
 #endif /* COOKIE_BUG */
+
+#endif /* 0 -- pin */

--- src/preproc/html/pre-html.cc.ori    2003-03-30 00:10:59.000000000 +0100
+++ src/preproc/html/pre-html.cc        2003-03-30 01:35:41.000000000 +0100
@@ -307,7 +307,12 @@
   char *p;
   char *np;
   va_list ap;
+#if 0 /* pin */
   if ((p = (char *)malloc (size)) == NULL)
+#else
+  p = new char[size];
+  if (p == NULL)
+#endif
     return NULL;
   while (1) {
     /* Try to print in the allocated space. */
@@ -318,7 +323,11 @@
     if (n > -1 && n < size) {
       if (size > n+1) {
        np = strsave(p);
+#if 0 /* pin */
        free(p);
+#else
+        delete[] p;
+#endif
        return np;
       }
       return p;
@@ -328,11 +337,19 @@
       size = n+1; /* precisely what is needed */
     else           /* glibc 2.0 */
       size *= 2;  /* twice the old size */
+#if 0 /* pin */
     if ((np = (char *)realloc (p, size)) == NULL) {
       free(p);  /* realloc failed, free old, p. */
       return NULL;
     }
     p = np;  /* use realloc'ed, p */
+#else
+    delete[] p;
+    p = new char[size];
+    if(p == NULL){
+      return NULL;
+    }
+#endif
   }
 }
 

_______________________________________________
Bug-groff mailing list
address@hidden
http://mail.gnu.org/mailman/listinfo/bug-groff


----- End forwarded message -----