Bug 33513 - doc/chew: heap-use-after-free
Summary: doc/chew: heap-use-after-free
Status: RESOLVED WONTFIX
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: 2.45
: P2 minor
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-10-02 11:30 UTC by Frank Busse
Modified: 2026-02-27 21:53 UTC (History)
0 users

See Also:
Host:
Target:
Build:
Last reconfirmed:
Project(s) to access:
ssh public key:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Frank Busse 2025-10-02 11:30:33 UTC 
Hi,

I tested chew with klovo.io's KLEE extension and found some issues, e.g.:

$ printf ':\x0c""\x00\x03\x03\x03' > input1
$ echo "" | ./chew '-f' input1
==552338==ERROR: AddressSanitizer: heap-use-after-free
READ of size 8 at 0x7c12a95e0d60 thread T0
    #0 0x55d1f1f3bc11 in free_words doc/chew.c:1219
    #1 0x55d1f1f3bc11 in main doc/chew.c:1607
...


$ printf '\x0c:\\\x0c""-\x01' > input2
$ printf '/**/\x00///' | ./chew '-f' input2
=================================================================
==552628==ERROR: AddressSanitizer: heap-use-after-free
READ of size 8 at 0x7b4a381e0d60 thread T0
    #0 0x55bc94344fff in lookup_word doc/chew.c:1201
    #1 0x55bc94346a21 in perform doc/chew.c:1258
    #2 0x55bc94346a21 in main doc/chew.c:1591
...

Kind regards,

Frank
Comment 1 Alan Modra 2026-02-27 21:53:11 UTC 
Your input1 file is an broken program for chew.  It is unsurprising that it breaks chew.