heap-buffer-overflow WRITE

[asarubbo]

Describe the bug
By compiling givaro-4.2.0 with --enable-doc I get a random segfault.

Looking at dmesg I can see:

[Mon Nov  4 14:27:51 2024] traps: doxygen[52992] general protection fault ip:7ad14294a8b7 sp:7ffd99346848 error:0 in libc.so.6[7ad14280a000+169000]

So I have recompiled doxygen with address sanitizer and here is the output:

==2437==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50b0001983e8 at pc 0x61f90e1d59ed bp 0x7ffc5bf2dec0 sp 0x7ffc5bf2d690
WRITE of size 17961 at 0x50b0001983e8 thread T0
    #0 0x61f90e1d59ec in read (/usr/bin/doxygen+0x47a9ec)
    #1 0x7eae5daf3a5e in std::__basic_file<char>::xsgetn(char*, long) (/usr/lib/gcc/x86_64-pc-linux-gnu/15/libstdc++.so.6+0xf3a5e)
    #2 0x7eae5db23cf9 in std::basic_filebuf<char, std::char_traits<char>>::xsgetn(char*, long) (/usr/lib/gcc/x86_64-pc-linux-gnu/15/libstdc++.so.6+0x123cf9)
    #3 0x7eae5db3139f in std::istream::read(char*, long) (/usr/lib/gcc/x86_64-pc-linux-gnu/15/libstdc++.so.6+0x13139f)
    #4 0x61f90efdf9af in readInputFile(QCString const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&, bool, bool) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/util.cpp:5791:7
    #5 0x61f90f4632bf in checkAndOpenFile(yyguts_t*, QCString const&, bool&) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/pre.l:2237:10
    #6 0x61f90f461b9c in findFile(yyguts_t*, QCString const&, bool, bool&) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/pre.l:2257:15
    #7 0x61f90f444e47 in readIncludeFile(yyguts_t*, QCString const&) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/pre.l:3558:8
    #8 0x61f90f41e115 in preYYlex(yyguts_t*) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/pre.l:1256:45
    #9 0x61f90f452af7 in Preprocessor::processFile(QCString const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/pre.l:4039:3
    #10 0x61f90e320529 in parseFile(OutlineParserInterface&, FileDef*, QCString const&, ClangTUParser*, bool) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/doxygen.cpp:10296:18
    #11 0x61f90e2b6840 in parseFilesSingleThreading(std::shared_ptr<Entry> const&) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/doxygen.cpp:10553:41
    #12 0x61f90e2b281b in parseInput() /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/doxygen.cpp:12229:5
    #13 0x61f90e29b165 in main /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/main.cpp:37:3
    #14 0x7eae5d8393fa  (/lib64/libc.so.6+0x263fa)
    #15 0x7eae5d8394b3 in __libc_start_main (/lib64/libc.so.6+0x264b3)
    #16 0x61f90e1b7614 in _start (/usr/bin/doxygen+0x45c614)

0x50b0001983e8 is located 0 bytes after 104-byte region [0x50b000198380,0x50b0001983e8)
allocated by thread T0 here:
/usr/lib/llvm/19/bin/llvm-symbolizer: error: '[stack]': No such file or directory
    #0 0x61f90e298cb1 in operator new(unsigned long) (/usr/bin/doxygen+0x53dcb1)
    #1 0x61f90f474a80 in std::__detail::_MakeUniq<FileState>::__single_object std::make_unique<FileState>() /usr/lib/gcc/x86_64-pc-linux-gnu/15/include/g++-v15/bits/unique_ptr.h:1077:30
    #2 0x61f90f46326d in checkAndOpenFile(yyguts_t*, QCString const&, bool&) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/pre.l:2236:10
    #3 0x61f90f461b9c in findFile(yyguts_t*, QCString const&, bool, bool&) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/pre.l:2257:15
    #4 0x61f90f444e47 in readIncludeFile(yyguts_t*, QCString const&) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/pre.l:3558:8
    #5 0x61f90f41e115 in preYYlex(yyguts_t*) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/pre.l:1256:45
    #6 0x61f90f452af7 in Preprocessor::processFile(QCString const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/pre.l:4039:3
    #7 0x61f90e320529 in parseFile(OutlineParserInterface&, FileDef*, QCString const&, ClangTUParser*, bool) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/doxygen.cpp:10296:18
    #8 0x61f90e2b6840 in parseFilesSingleThreading(std::shared_ptr<Entry> const&) /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/doxygen.cpp:10553:41
    #9 0x61f90e2b281b in parseInput() /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/doxygen.cpp:12229:5
    #10 0x61f90e29b165 in main /var/tmp/portage/app-text/doxygen-1.12.0/work/doxygen-1.12.0/src/main.cpp:37:3
    #11 0x7eae5d8393fa  (/lib64/libc.so.6+0x263fa)
    #12 0x7ffc5bf403dd  ([stack]+0x653dd)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/bin/doxygen+0x47a9ec) in read
Shadow bytes around the buggy address:
  0x50b000198100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50b000198180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50b000198200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50b000198280: fa fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd
  0x50b000198300: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
=>0x50b000198380: 00 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa fa
  0x50b000198400: fa fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd
  0x50b000198480: fd fd fd fa fa fa fa fa fa fa fa fa fd fd fd fd
  0x50b000198500: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
  0x50b000198580: fa fa 00 00 00 00 00 00 00 00 00 00 00 00 00 fa
  0x50b000198600: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==2437==ABORTING

The givaro archive is public, so not worth attaching it here:
https://github.com/linbox-team/givaro/archive/refs/tags/v4.2.0.tar.gz

The doxygen command I can see running is just doxygen Doxyfile

If I can do something else, please let me know.

[albert-github]

In the given repository I didn't find a Doxyfile though I found Doxyfile.mod and DoxyfileDev.mod which one did you use?
I tried the DoxyfileDev.mod with the doxygen 1.12.0 version on Windows and Cygwin but had no problems.
You wrote:

So I have recompiled doxygen with address sanitizer and here is the output:

Which version did you use here? 1.12.0 or the current master?

• When you used 1.12.0 can you also try the current master with the sanitizer?

• Which OS version did you use and which version of the compiler did you use?

The givaro archive is public, so not worth attaching it here:

It is always better (and easier) to attach the example and to try to cut down the example, so:

• Can you please attach a, small, self contained example (source+configuration file in a, compressed, tar or zip file!) that allows us to reproduce the problem? Please don't add external links as they might not be persistent (also references to GitHub repositories are considered non persistent).

[albert-github]

What are your settings in respect to the system limits (I think this is reported by the command ulimit) as it looks a bit like your system is running out of memory.

[asarubbo]

To be clear I'm not compiling it manually but I'm compiling it via Portage

In the given repository I didn't find a Doxyfile though I found Doxyfile.mod and DoxyfileDev.mod which one did you use?

The file used is Doxyfile.mod. I found this in givaro-doc.m4 that explains why you didn't find Doxyfile:

[ cp "$srcdir"/docs/Doxyfile.mod docs/Doxyfile ;

I tried the DoxyfileDev.mod with the doxygen 1.12.0 version on Windows and Cygwin but had no problems.

I don't know why, but this is not 100% reproducible

Which version did you use here? 1.12.0 or the current master?

1.12.0 ( it was in the stacktrace paths, that's because I did not state a a version)

• When you used 1.12.0 can you also try the current master with the sanitizer?

I will try and report back

• Which OS version did you use and which version of the compiler did you use?

Gentoo, clang-19.1.3, but reproducible also with gcc-15

• Can you please attach a, small, self contained example (source+configuration file in a, compressed, tar or zip file!) that allows us to reproduce the problem? Please don't add external links as they might not be persistent (also references to GitHub repositories are considered non persistent).

Sure, I will prepare and attach it.

What are your settings in respect to the system limits (I think this is reported by the command ulimit) as it looks a bit like your system is running out of memory.

ulimit is unlimited. I don't guess it is an out-of-memory, because for that I should be able to see it via dmesg. (there are 256GB of ram here of which 10GB occupied btw)

[asarubbo]

I can reproduce on master at commit 3b8b4a2, this is the new output:

==65350==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50b0007f8ab8 at pc 0x55d8b33e0c4d bp 0x7ffd4345ba40 sp 0x7ffd4345b210
WRITE of size 10095 at 0x50b0007f8ab8 thread T0                                                                                                                                        
    #0 0x55d8b33e0c4c in read (/usr/bin/doxygen+0x483c4c)                                                                                                                              
    #1 0x71f8a2ef3a5e in std::__basic_file<char>::xsgetn(char*, long) (/usr/lib/gcc/x86_64-pc-linux-gnu/15/libstdc++.so.6+0xf3a5e)
    #2 0x71f8a2f23cf9 in std::basic_filebuf<char, std::char_traits<char>>::xsgetn(char*, long) (/usr/lib/gcc/x86_64-pc-linux-gnu/15/libstdc++.so.6+0x123cf9)
    #3 0x71f8a2f3139f in std::istream::read(char*, long) (/usr/lib/gcc/x86_64-pc-linux-gnu/15/libstdc++.so.6+0x13139f)                                              09:07:02 [35/46978]
    #4 0x55d8b4225faf in readInputFile(QCString const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&, bool, bool) /var/tmp/portage/app-text/doxygen-
9999/work/doxygen-9999/src/util.cpp:5857:7                                                 
    #5 0x55d8b46ae84f in checkAndOpenFile(yyguts_t*, QCString const&, bool&) /var/tmp/portage/app-text/doxygen-9999/work/doxygen-9999/src/pre.l:2254:10
    #6 0x55d8b46ad12c in findFile(yyguts_t*, QCString const&, bool, bool&) /var/tmp/portage/app-text/doxygen-9999/work/doxygen-9999/src/pre.l:2274:15
    #7 0x55d8b4690547 in readIncludeFile(yyguts_t*, QCString const&) /var/tmp/portage/app-text/doxygen-9999/work/doxygen-9999/src/pre.l:3575:8
    #8 0x55d8b4669770 in preYYlex(yyguts_t*) /var/tmp/portage/app-text/doxygen-9999/work/doxygen-9999/src/pre.l:1273:45
    #9 0x55d8b469e1a6 in Preprocessor::processFile(QCString const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<c
har, std::char_traits<char>, std::allocator<char>>&) /var/tmp/portage/app-text/doxygen-9999/work/doxygen-9999/src/pre.l:4057:3
    #10 0x55d8b3532599 in parseFile(OutlineParserInterface&, FileDef*, QCString const&, ClangTUParser*, bool) /var/tmp/portage/app-text/doxygen-9999/work/doxygen-9999/src/doxygen.cpp:
10611:18                                                                                   
    #11 0x55d8b34c1e60 in parseFilesSingleThreading(std::shared_ptr<Entry> const&) /var/tmp/portage/app-text/doxygen-9999/work/doxygen-9999/src/doxygen.cpp:10868:41
    #12 0x55d8b34bde9b in parseInput() /var/tmp/portage/app-text/doxygen-9999/work/doxygen-9999/src/doxygen.cpp:12574:5
    #13 0x55d8b34a63c5 in main /var/tmp/portage/app-text/doxygen-9999/work/doxygen-9999/src/main.cpp:37:3
    #14 0x71f8a2c393fa  (/lib64/libc.so.6+0x263fa)               
    #15 0x71f8a2c394b3 in __libc_start_main (/lib64/libc.so.6+0x264b3)
    #16 0x55d8b33c2874 in _start (/usr/bin/doxygen+0x465874)
                                                                                           
0x50b0007f8ab8 is located 0 bytes after 104-byte region [0x50b0007f8a50,0x50b0007f8ab8)
allocated by thread T0 here: 
/usr/lib/llvm/19/bin/llvm-symbolizer: error: '[stack]': No such file or directory
    #0 0x55d8b34a3f11 in operator new(unsigned long) (/usr/bin/doxygen+0x546f11)
    #1 0x55d8b46c00a0 in std::__detail::_MakeUniq<FileState>::__single_object std::make_unique<FileState>() /usr/lib/gcc/x86_64-pc-linux-gnu/15/include/g++-v15/bits/unique_ptr.h:1077:
30                           
    #2 0x55d8b46ae7fd in checkAndOpenFile(yyguts_t*, QCString const&, bool&) /var/tmp/portage/app-text/doxygen-9999/work/doxygen-9999/src/pre.l:2253:10
    #3 0x55d8b46ad12c in findFile(yyguts_t*, QCString const&, bool, bool&) /var/tmp/portage/app-text/doxygen-9999/work/doxygen-9999/src/pre.l:2274:15
    #4 0x55d8b4690547 in readIncludeFile(yyguts_t*, QCString const&) /var/tmp/portage/app-text/doxygen-9999/work/doxygen-9999/src/pre.l:3575:8
    #5 0x55d8b4669770 in preYYlex(yyguts_t*) /var/tmp/portage/app-text/doxygen-9999/work/doxygen-9999/src/pre.l:1273:45
    #6 0x55d8b469e1a6 in Preprocessor::processFile(QCString const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<c
har, std::char_traits<char>, std::allocator<char>>&) /var/tmp/portage/app-text/doxygen-9999/work/doxygen-9999/src/pre.l:4057:3
    #7 0x55d8b3532599 in parseFile(OutlineParserInterface&, FileDef*, QCString const&, ClangTUParser*, bool) /var/tmp/portage/app-text/doxygen-9999/work/doxygen-9999/src/doxygen.cpp:1
0611:18                      
    #8 0x55d8b34c1e60 in parseFilesSingleThreading(std::shared_ptr<Entry> const&) /var/tmp/portage/app-text/doxygen-9999/work/doxygen-9999/src/doxygen.cpp:10868:41
    #9 0x55d8b34bde9b in parseInput() /var/tmp/portage/app-text/doxygen-9999/work/doxygen-9999/src/doxygen.cpp:12574:5
    #10 0x55d8b34a63c5 in main /var/tmp/portage/app-text/doxygen-9999/work/doxygen-9999/src/main.cpp:37:3
    #11 0x71f8a2c393fa  (/lib64/libc.so.6+0x263fa)
    #12 0x7ffd4346f243  ([stack]+0x68243)
SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/bin/doxygen+0x483c4c) in read
Shadow bytes around the buggy address:
  0x50b0007f8800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50b0007f8880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50b0007f8900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50b0007f8980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50b0007f8a00: fa fa fa fa fa fa fa fa fa fa 00 00 00 00 00 00
=>0x50b0007f8a80: 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa
  0x50b0007f8b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 02 fa fa
  0x50b0007f8b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50b0007f8c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50b0007f8c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50b0007f8d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==65350==ABORTING

Here is the tarball that you can use to reproduce.
As said this is not 100% reproducible (dunno why, but usually I can reproduce it in less than 5 minutes), so if you launch the run script it will hang after get the overflow.

docs.zip

[doxygen]

@asarubbo Very curious issue. I have not been able to reproduce it.

Looks also like the code mentioned in the stack trace is not really something that can go wrong.

Starting here in the stack trace:

#5 0x55d8b46ae84f in checkAndOpenFile(yyguts_t*, QCString const&, bool&) /var/tmp/portage/app-text/doxygen-9999/work/doxygen-9999/src/pre.l:2254:10

This does

    fs = std::make_unique<FileState>();
    if (!readInputFile(absName,fs->fileBuf))

where fs->fileBuf is a std::string

Then in util.cpp, the following relevant code is executed:

bool readInputFile(const QCString &fileName,std::string &contents,bool filter,bool isSourceCode)
{
  // try to open file
  FileInfo fi(fileName.str());
  ...
  if (filterName.isEmpty() || !filter)    // <-- true
  {
    std::ifstream f = Portable::openInputStream(fileName,true);
    ...
    contents.resize(fi.size());
    f.read(contents.data(),fi.size());

which then crashes in the f.read() call.

Since this is Gentoo, which builds everything from source code if I remember correctly, maybe the compiler produces incorrect code.

The ebuild file (https://data.gpo.zugaina.org/gentoo/app-text/doxygen/doxygen-9999.ebuild) also has a note

                # TODO: Investigate this and report a bug accordingly...
		ewarn "Compiling with -O3 is known to produce incorrectly"
		ewarn "optimized code which breaks doxygen. Using -O2 instead."
		replace-flags "-O3" "-O2""

So maybe different compilation flags may help. If you can add some prints in this part of the code, it may also shed some light on what is going wrong. Otherwise, I'm afraid we need to start looking at the produced assembly code.

[asarubbo]

Hello @doxygen

thanks for the feedback.

When I run asan, usually I compile the code with -O0 but in this case it was reproduced originally also with -O2. In any case replace-flags "-O3" "-O2"" means that if you have -O3, the package manager replaces -O3 with -O2 (replace-flags is a function)

I can reproduce with both gcc-15 and clang-19, so I doubt there is a bug in the compiler unless there is a bug in both.

If you can send me the diff I can try whatever you want :)

In the meantime I'll try to reproduce on a different environment/distro.

NOTE: not really related to this, but doxygen -V may print enabled configure options (if any) and how it was compiled (like how nginx -V does)

[albert-github]

NOTE: not really related to this, but doxygen -V may print enabled configure options (if any) and how it was compiled (like how nginx -V does)

Might be a nice enhancement, though doxygen already shows some information.

• what does nginx -V output ?
• can you create a new issue for this

[doxygen]

@asarubbo

Can you apply this patch and let me know the output of the last 3 lines with ### before the crash?

diff --git a/src/pre.l b/src/pre.l
index 1ede208a18..e0c5b08775 100644
--- a/src/pre.l
+++ b/src/pre.l
@@ -2250,6 +2250,7 @@ static std::unique_ptr<FileState> checkAndOpenFile(yyscan_t yyscanner,const QCSt
     //printf("#include %s\n",qPrint(absName));
 
     fs = std::make_unique<FileState>();
+    fprintf(stderr,"### fs=%p fs->fileBuf.data()=%p fileName=%s\n",(void*)fs.get(),(void*)fs->fileBuf.data(),qPrint(fileName));
     if (!readInputFile(absName,fs->fileBuf))
     { // error
       //printf("  error reading\n");
diff --git a/src/util.cpp b/src/util.cpp
index 3f11fbb80d..6b49f71447 100644
--- a/src/util.cpp
+++ b/src/util.cpp
@@ -5853,7 +5853,12 @@ bool readInputFile(const QCString &fileName,std::string &contents,bool filter,bo
       return FALSE;
     }
     // read the file
+    fprintf(stderr,"### fi.size()=%zu contents.size()=%zu contents.data()=%p\n",fi.size(),contents.size(),(void*)contents.data());
     contents.resize(fi.size());
+    f.seekg(0,f.end);
+    size_t length = f.tellg();
+    f.seekg(0,f.beg);
+    fprintf(stderr,"### f.size()=%zu contents.size()=%zu contents.data()=%p\n",length,contents.size(),(void*)contents.data());
     f.read(contents.data(),fi.size());
     if (f.fail())
     {

[asarubbo]

Can you apply this patch and let me know the output of the last 3 lines with ### before the crash?

Done, I'm attaching the full output so everything will be more clear.
output.txt

[doxygen]

@asarubbo I see the last reported file path has a lot of repeats of givaro:

/var/tmp/portage/sci-libs/givaro-4.2.0-r1/work/givaro-4.2.0/src/library/tools/
givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/
givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/
givaro/givaro/givtruncdomain.h

Can you check if there is a recursive symlink perhaps?
Can you check if setting EXCLUDE_SYMLINKS = YES makes a difference?

[albert-github]

My 2 cents ...
Looks indeed like a symbolic link tough in the bare repository download and the release tar file I didn't see that but when searching for ln I found this in config.ac in the part:

for link in \
        src/kernel/system/givaro   \
        src/kernel/bstruct/givaro  \
        src/kernel/integer/givaro  \
        src/kernel/memory/givaro   \
        src/kernel/rational/givaro \
        src/kernel/recint/recint   \
        src/kernel/field/givaro    \
        src/kernel/ring/givaro     \
        src/kernel/gmp++/gmp++     \
        src/library/matrix/givaro  \
        src/library/poly1/givaro   \
        src/library/tools/givaro   \
        src/library/vector/givaro  \
        ; do

        dir="$(dirname "$link")"
        AS_MKDIR_P([$dir])
        case "$srcdir$" in
            /*) ln -sf          "$srcdir/$dir" "$link" ;;
             *) ln -sf "../../../$srcdir/$dir" "$link" ;;
        esac
done

so probably this adds the symbolic link that @doxygen mentioned and that probably could be prevented by EXCLUDE_SYMLINKS = YES.

I also looked at the length of:

/var/tmp/portage/sci-libs/givaro-4.2.0-r1/work/givaro-4.2.0/src/library/tools/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givaro/givtruncdomain.h

and this is 262 characters long whilst with one /givaro less it is 255 characters, so this looks like a buffer overflow.
I don't know what the settings are on gentoo (or @asarubbo on your local system)for e.g. PATH_MAX and FILENAME_MAX).

[doxygen]

@asarubbo While looking at output.txt, the only reason I can explain what I see is if the fi.size() returns 0 for the line contents.resize(fi.size());, and then something non-zero for the f.read(contents.data(),fi.size()); line that follows it.

In the commit I now cache the value of fi.size(). Can you check if that fixes the problem for you? I still cannot reproduce it even with the recursive links in place.