Re: [bug #62040] [troff] double-free crash provoked by HTML man(7) output

[Bjarni Ingi Gislason]

On Tue, Mar 15, 2022 at 06:41:52PM -0400, G. Branden Robinson wrote:
> Follow-up Comment #5, bug #62040 (project groff):
> 
> 
> [comment #2 comment #2:]
> >   I neither get an empty line nor a memory dump.
> > 
> >   I use the most recent files in the gnulib git repository.
> > 
> >   I have eliminated those warnings from the gcc compiler (latest in the
> > testing distribution of Debian), that are easy to fix.
> > 
> 
> Hi Bjarni,
> 
> This feedback is not as helpful as it could be.  Do you know if:
> 
> 1) Upgrading gnulib is, by itself, sufficient to fix the problem?
> 
  I don't know.  Just update gnulib and fix its side-effects to find
out.

  Gnulib's development is currently pausing as there are practically no
new bug reports; {older have been, new are} swiftly fixed.

> And if it isn't,
> 
> 2) Which warning-suppression fix is?
> 

  I don't know.  I use these compiler options:

FLAGS_COMMON="\
-Wall -Wextra -Wformat=2 \
-Wattribute-warning \
-Wimplicit-fallthrough=3 \
-Wmaybe-uninitialized \
-Wstringop-overflow=4 \
-Wredundant-decls \
-Wshadow=global \
-Wunused \
-Wunused-parameter \
-fsanitize=bool \
-fsanitize=enum \
-fsanitize=signed-integer-overflow \
-fsanitize-undefined-trap-on-error \
-O2 \
-fstack-protector-strong -fno-common \
-fstack-clash-protection \
-ftrapv \
-funsigned-char \
-fvar-tracking-assignments \
-ggdb \
-flto \
-Walloc-zero \
"
CPPFLAGS="-D_FORTIFY_SOURCE=2 \
-DGCC_LINT \
"

CFLAGS="\
$FLAGS_COMMON \
-Wmissing-prototypes \
-Wold-style-definition -Wstrict-prototypes  \
-Wold-style-declaration  \
-std=c2x \
"

CXXFLAGS="\
$FLAGS_COMMON \
-fcheck-new \
-Wredundant-decls \
-Wdelete-incomplete \
-std=c++20 \
"

  And sometimes additionally

-fanalyzer


> And moreover, are _both_ a gnulib upgrade and a warning-suppression fix
> required?
> 

  I don't know.

> As Ingo has suggested, we don't want to fire blindly when fixing compiler
> warnings.  It is not sufficient to address them; we must also _understand_
> them.
> 

  I fix warnings if I know how to do it.  Warnings need only to make
sense to me.  If these fixes introduce a bug, I either see it or not.
And when I apply fixes I also get a rudimentary test by compiling the
software (including the "check" target) and by reading man pages always
with my latest "test-nroff", using the ".manpath" file from "man-db".

#### .manpath ####

DEFINE  troff   test-groff -mandoc -rF=0 -rCHECKSTYLE=5
DEFINE  nroff   test-nroff -mandoc -rF=0 -P-i -rHY=0 -dAD=l -rCHECKSTYLE=0
# test-nroff is in my git/groff repository and is similar to "nroff"
# there (and includes options '-b' and -ww')
# except "test-groff" is used instead of "groff".
# man-db environmental variable "MAN_KEEP_STDERR" set to "=yes"
# MANOPT=-E latin1 --no-hyphenation --no-justification --warnings=w


####


> The above information would expedite the resolution of this bug.  Failing
> that, it's going to require more time and experimentation on my part.
> 

  Just update gnulib (first in your private groff repository) and fix
eventual side effects (the compiler will report them, especially
linking trouble).

-- 
Bjarni I. Gislason