Update of bug #68552 (group groff):
Summary: [troff] memory corruption in `token::description()`
in `TOKEN_NODE` case => [PATCH] [troff] memory corruption in
`token::description()` in `TOKEN_NODE` case
_______________________________________________________
Follow-up Comment #5:
I believe I have a fix.
diff --git a/ChangeLog b/ChangeLog
index 2b5eab007..03b96bb08 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,25 @@
+2026-07-24 G. Branden Robinson <[email protected]>
+
+ [troff]: Fix Savannah #68552.
+
+ * src/roff/troff/input.cpp (token::description): Simplify
+ population of buffer describing a node token and avoid
+ potentially overwriting a heap-allocated buffer if that node's
+ description is lengthy (as "non-interpreted character nodes",
+ input in *roff as `\a` and `\t`, are). Discard stale code that
+ uselessly performed a dead store of a dummy node description;
+ `describe_node()` zeroes out its destination buffer so that
+ became pointless a while back. Then, simply measure the buffer
+ as populated by `describe_node()` with strlen(3) and append to
+ it carefully with strncat(3), respecting `bufsz`.
+
+ Fixes <https://savannah.gnu.org/bugs/?68558>. I believe I
+ introduced this problem during the groff 1.24.0 development
+ cycle in the course of my "node tree dumping death march", but
+ have not tracked it down to a specific commit. See generally
+ <https://lists.gnu.org/archive/html/groff-commit/2025-03/\
+ index.html>.
+
2026-07-24 G. Branden Robinson <[email protected]>
[groff]: Regression-test Savannah #68552.
diff --git a/src/roff/troff/input.cpp b/src/roff/troff/input.cpp
index f63de35e5..6565be5bc 100644
--- a/src/roff/troff/input.cpp
+++ b/src/roff/troff/input.cpp
@@ -3146,10 +3146,9 @@ const char *token::description()
return "a newline";
case TOKEN_NODE:
{
- static char nodebuf[bufsz - (sizeof " token")];
- (void) strcpy(nodebuf, "an undescribed node");
- describe_node(nodebuf, bufsz);
- (void) snprintf(buf, bufsz, "%s token", nodebuf);
+ describe_node(buf, bufsz);
+ size_t len = strlen(buf);
+ (void) strncat(buf, " token", bufsz - len - 1 /* '\0' */);
return buf;
}
case TOKEN_INDEXED_CHAR:
_______________________________________________________
Reply to this item at:
<https://savannah.gnu.org/bugs/?68552>
_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/
signature.asc
Description: PGP signature
