[bug #66269] double free when .IP indentation is less than the length of the tag

[anonymous]

URL:
  <https://savannah.gnu.org/bugs/?66269>

                 Summary: double free when .IP indentation is less than the
length of the tag
                   Group: GNU roff
               Submitter: None
               Submitted: Sat 28 Sep 2024 03:32:02 PM UTC
                Category: None
                Severity: 3 - Normal
              Item Group: Crash/Unresponsive
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: None


    _______________________________________________________

Follow-up Comments:


-------------------------------------------------------
Date: Sat 28 Sep 2024 03:32:02 PM UTC By: Anonymous
This causes a double free and then aborts:


echo ".IP 88888888 7" | groff -man -T html > /dev/null


It's dependant on the tag's length, this will cause the same behavior:


echo ".IP 4444 3" | groff -man -T html > /dev/null


When the indentation number is greater than or equal to the length of the tag,
it stops happening:


echo ".IP 4444 4" | groff -man -T html > /dev/null
echo ".IP 4444 5" | groff -man -T html > /dev/null


Also stops happening when you change the output device:


echo ".IP 4444 3" | groff -man -T pdf > /dev/null









    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?66269>

_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/

signature.asc
Description: PGP signature