[bug #62040] [troff] double-free crash provoked by HTML man(7) output

[Dave]

Follow-up Comment #3, bug #62040 (project groff):

For posterity, this bug revealed itself in the thread
http://lists.gnu.org/r/groff/2022-02/msg00037.html, which was started to
report a minor rendering problem.

I get the crash on a groff built on November 3 from the then most recent
sources.

$ groff --version
GNU groff version 1.23.0.rc1.1499-34c5f
Copyright (C) 2020 Free Software Foundation, Inc.
GNU groff comes with ABSOLUTELY NO WARRANTY.
You may redistribute copies of groff and its subprograms
under the terms of the GNU General Public License.
For more information about these matters, see the file
named COPYING.

called subprograms:

GNU grops (groff) version 1.23.0.rc1.1499-34c5f
GNU troff (groff) version 1.23.0.rc1.1499-34c5f
$ cat 62040
.TH foo 1 2022-02-12 "groff test suite"
.TP 1n \" not enough room for 'A' plus a space, so break after 'A'
A
.\" ...but input unexpectedly ends.
$ groff -man -Thtml 62040 | wc
free(): double free detected in tcache 2
groff: error: troff: Aborted
     29      84     820
$ sed s/1n/2n/ 62040 | groff -man -Thtml | wc
     39     101    1005
$ 


    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?62040>

_______________________________________________
  Message sent via Savannah
  https://savannah.gnu.org/