ptx: fix an invalid heap reference with short --width

* src/ptx.c (fix_output_parameters): Ensure line_width doesn't
go negative, which can happen when the --width is less
than the --gap-size.
* tests/misc/ptx-overrun.sh: Add a test case that triggers
with ASAN.  (Note the longer filename is needed to trigger).
Fixes http://bugs.gnu.org/25011

diff --git a/src/ptx.c b/src/ptx.c
index c3b60dfa5b9844e7c8cab4794e7d7d11c556e9a7..d1896789b01437a3277bf3bace76d795120144bb 100644 (file)
--- a/src/ptx.c
+++ b/src/ptx.c
@@ -1235,6 +1235,8 @@ fix_output_parameters (void)
 
   if ((auto_reference || input_reference) && !right_reference)
     line_width -= reference_max_width + gap_size;
+  if (line_width < 0)
+    line_width = 0;
 
   /* The output lines, minimally, will contain from left to right a left
      context, a gap, and a keyword followed by the right context with no

diff --git a/tests/misc/ptx-overrun.sh b/tests/misc/ptx-overrun.sh
index a4f2e382e1e570727a6651d684928ff0d832a01f..3b46812644f018c3e76393fb7d2ee9c9e488eab4 100755 (executable)
--- a/tests/misc/ptx-overrun.sh
+++ b/tests/misc/ptx-overrun.sh
@@ -41,4 +41,9 @@ ptx ws.in ws.in | sort | uniq -u > out
 compare /dev/null out || fail=1
 
 
+# Trigger an invalid heap reference noticed by gcc -fsanitize=address
+# from coreutils-8.25 and earlier.
+echo a > a
+ptx -w1 -A $PWD/a >/dev/null || fail=1
+
 Exit $fail