Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 942336 - app-text/doxygen-1.12.0 heap overflow when compiling givaro docs - WAS: sci-libs/givaro-4.2.0 [doc] fails to compile: make: [Makefile:500: docs] Segmentation fault
Summary: app-text/doxygen-1.12.0 heap overflow when compiling givaro docs - WAS: sci-l...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Matthias Maier
URL:
Whiteboard:
Keywords: PullRequest
Depends on:
Blocks: gcc-15
  Show dependency tree
 
Reported: 2024-10-27 10:12 UTC by Agostino Sarubbo
Modified: 2025-03-15 15:09 UTC (History)
4 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
build.log (build.log,272.05 KB, text/plain)
2024-10-27 10:12 UTC, Agostino Sarubbo
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2024-10-27 10:12:50 UTC
https://blogs.gentoo.org/ago/2020/07/04/gentoo-tinderbox/

Issue: sci-libs/givaro-4.2.0 fails to compile.
Discovered on: amd64 (internal ref: gcc15_tinderbox)
System: GCC-15-SYSTEM (https://wiki.gentoo.org/wiki/Project:Tinderbox/Common_Issues_Helper#GCC-15)

Info about the issue:
https://wiki.gentoo.org/wiki/Project:Tinderbox/Common_Issues_Helper#CF0014
Comment 1 Agostino Sarubbo gentoo-dev 2024-10-27 10:12:52 UTC
Created attachment 906991 [details]
build.log

build log and emerge --info
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2024-10-27 11:22:25 UTC
Not investigated but adding gcc-15 blocker just in case.
Comment 3 Michael Orlitzky gentoo-dev 2024-10-27 21:13:55 UTC
make[2]: *** [Makefile:500: docs] Segmentation fault

Did "make" itself segfault? This is a new one for me.
Comment 4 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2024-10-27 21:17:01 UTC
I took it to be doxygen..
Comment 5 Michael Orlitzky gentoo-dev 2024-11-02 21:05:59 UTC
@ago, is this reproducible? Something's wrong here... probably not with givaro, but something.
Comment 6 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2024-11-02 21:11:19 UTC
I can't reproduce it FWIW.
Comment 7 Agostino Sarubbo gentoo-dev 2024-11-04 12:36:56 UTC
(In reply to Michael Orlitzky from comment #5)
> @ago, is this reproducible? Something's wrong here... probably not with
> givaro, but something.

I'm trying, but this is only with USE=doc
Comment 8 Agostino Sarubbo gentoo-dev 2024-11-04 14:24:16 UTC
sam was right:

==2437==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50b0001983e8 at pc 0x61f90e1d59ed bp 0x7ffc5bf2dec0 sp 0x7ffc5bf2d690
WRITE of size 17961 at 0x50b0001983e8 thread T0
    #0 0x61f90e1d59ec in read (/usr/bin/doxygen+0x47a9ec)
    #1 0x7eae5daf3a5e in std::__basic_file<char>::xsgetn(char*, long) (/usr/lib/gcc/x86_64-pc-linux-gnu/15/libstdc++.so.6+0xf3a5e)
    #2 0x7eae5db23cf9 in std::basic_filebuf<char, std::char_traits<char>>::xsgetn(char*, long) (/usr/lib/gcc/x86_64-pc-linux-gnu/15/libstdc++.so.6+0x123cf9)
    #3 0x7eae5db3139f in std::istream::read(char*, long) (/usr/lib/gcc/x86_64-pc-linux-gnu/15/libstdc++.so.6+0x13139f)
    #4 0x61f90efdf9af in readInputFile(QCString const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&, bool, bool) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/util.cpp:5791:7
    #5 0x61f90f4632bf in checkAndOpenFile(yyguts_t*, QCString const&, bool&) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/pre.l:2237:10
    #6 0x61f90f461b9c in findFile(yyguts_t*, QCString const&, bool, bool&) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/pre.l:2257:15
    #7 0x61f90f444e47 in readIncludeFile(yyguts_t*, QCString const&) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/pre.l:3558:8
    #8 0x61f90f41e115 in preYYlex(yyguts_t*) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/pre.l:1256:45
    #9 0x61f90f452af7 in Preprocessor::processFile(QCString const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/pre.l:4039:3
    #10 0x61f90e320529 in parseFile(OutlineParserInterface&, FileDef*, QCString const&, ClangTUParser*, bool) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/doxygen.cpp:10296:18
    #11 0x61f90e2b6840 in parseFilesSingleThreading(std::shared_ptr<Entry> const&) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/doxygen.cpp:10553:41
    #12 0x61f90e2b281b in parseInput() /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/doxygen.cpp:12229:5
    #13 0x61f90e29b165 in main /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/main.cpp:37:3
    #14 0x7eae5d8393fa  (/lib64/libc.so.6+0x263fa)
    #15 0x7eae5d8394b3 in __libc_start_main (/lib64/libc.so.6+0x264b3)
    #16 0x61f90e1b7614 in _start (/usr/bin/doxygen+0x45c614)

0x50b0001983e8 is located 0 bytes after 104-byte region [0x50b000198380,0x50b0001983e8)
allocated by thread T0 here:
/usr/lib/llvm/19/bin/llvm-symbolizer: error: '[stack]': No such file or directory
    #0 0x61f90e298cb1 in operator new(unsigned long) (/usr/bin/doxygen+0x53dcb1)
    #1 0x61f90f474a80 in std::__detail::_MakeUniq<FileState>::__single_object std::make_unique<FileState>() /usr/lib/gcc/x86_64-pc-linux-gnu/15/include/g++-v15/bits/unique_ptr.h:1077:30
    #2 0x61f90f46326d in checkAndOpenFile(yyguts_t*, QCString const&, bool&) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/pre.l:2236:10
    #3 0x61f90f461b9c in findFile(yyguts_t*, QCString const&, bool, bool&) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/pre.l:2257:15
    #4 0x61f90f444e47 in readIncludeFile(yyguts_t*, QCString const&) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/pre.l:3558:8
    #5 0x61f90f41e115 in preYYlex(yyguts_t*) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/pre.l:1256:45
    #6 0x61f90f452af7 in Preprocessor::processFile(QCString const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/pre.l:4039:3
    #7 0x61f90e320529 in parseFile(OutlineParserInterface&, FileDef*, QCString const&, ClangTUParser*, bool) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/doxygen.cpp:10296:18
    #8 0x61f90e2b6840 in parseFilesSingleThreading(std::shared_ptr<Entry> const&) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/doxygen.cpp:10553:41
    #9 0x61f90e2b281b in parseInput() /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/doxygen.cpp:12229:5
    #10 0x61f90e29b165 in main /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/main.cpp:37:3
    #11 0x7eae5d8393fa  (/lib64/libc.so.6+0x263fa)
    #12 0x7ffc5bf403dd  ([stack]+0x653dd)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/bin/doxygen+0x47a9ec) in read
Shadow bytes around the buggy address:
  0x50b000198100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50b000198180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50b000198200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50b000198280: fa fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd
  0x50b000198300: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
=>0x50b000198380: 00 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa fa
  0x50b000198400: fa fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd
  0x50b000198480: fd fd fd fa fa fa fa fa fa fa fa fa fd fd fd fd
  0x50b000198500: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
  0x50b000198580: fa fa 00 00 00 00 00 00 00 00 00 00 00 00 00 fa
  0x50b000198600: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==2437==ABORTING
Comment 9 Larry the Git Cow gentoo-dev 2025-03-15 15:08:00 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=46d2ea6fa7e185d28739e8eba271cc8bc1bf90c3

commit 46d2ea6fa7e185d28739e8eba271cc8bc1bf90c3
Author:     Kostadin Shishmanov <kostadinshishmanov@protonmail.com>
AuthorDate: 2025-03-14 21:06:50 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2025-03-15 15:07:16 +0000

    app-text/doxygen: add 1.13.2
    
    Bug: https://bugs.gentoo.org/942336
    Closes: https://bugs.gentoo.org/949923
    Signed-off-by: Kostadin Shishmanov <kostadinshishmanov@protonmail.com>
    Closes: https://github.com/gentoo/gentoo/pull/41089
    Signed-off-by: Sam James <sam@gentoo.org>

 app-text/doxygen/Manifest              |   1 +
 app-text/doxygen/doxygen-1.13.2.ebuild | 158 +++++++++++++++++++++++++++++++++
 2 files changed, 159 insertions(+)
Comment 10 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2025-03-15 15:09:06 UTC
Fixed in 1.13.0 per upstream bug.