gbranden pushed a commit to branch master
in repository groff.
commit 0ebb2ba4af49199a99e391ff1f359219ede058d6
Author: G. Branden Robinson <[email protected]>
AuthorDate: Fri Jul 24 16:21:00 2026 -0500
[troff]: Fix Savannah #68552.
* src/roff/troff/input.cpp (token::description): Simplify population of
buffer describing a node token and avoid potentially overwriting a
heap-allocated buffer if that node's description is lengthy (as
"non-interpreted character nodes", input in *roff as `\a` and `\t`,
are). Discard stale code that uselessly performed a dead store of a
dummy node description; `describe_node()` zeroes out its destination
buffer so that became pointless a while back. Then, simply measure
the buffer as populated by `describe_node()` with strlen(3) and append
to it carefully with strncat(3), respecting `bufsz`.
Fixes <https://savannah.gnu.org/bugs/?68552>. Thanks to Bruno Haible
for the investigation and advice. I believe I introduced this problem
during the groff 1.24.0 development cycle in the course of my "node tree
dumping death march", but have not tracked it down to a specific commit.
See generally
<https://lists.gnu.org/archive/html/groff-commit/2025-03/index.html>.
---
ChangeLog | 23 +++++++++++++++++++++++
src/roff/troff/input.cpp | 7 +++----
2 files changed, 26 insertions(+), 4 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index 6459ec737..8489308b1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,26 @@
+2026-07-24 G. Branden Robinson <[email protected]>
+
+ [troff]: Fix Savannah #68552.
+
+ * src/roff/troff/input.cpp (token::description): Simplify
+ population of buffer describing a node token and avoid
+ potentially overwriting a heap-allocated buffer if that node's
+ description is lengthy (as "non-interpreted character nodes",
+ input in *roff as `\a` and `\t`, are). Discard stale code that
+ uselessly performed a dead store of a dummy node description;
+ `describe_node()` zeroes out its destination buffer so that
+ became pointless a while back. Then, simply measure the buffer
+ as populated by `describe_node()` with strlen(3) and append to
+ it carefully with strncat(3), respecting `bufsz`.
+
+ Fixes <https://savannah.gnu.org/bugs/?68552>. Thanks to Bruno
+ Haible for the investigation and advice. I believe I introduced
+ this problem during the groff 1.24.0 development cycle in the
+ course of my "node tree dumping death march", but have not
+ tracked it down to a specific commit. See generally
+ <https://lists.gnu.org/archive/html/groff-commit/2025-03/\
+ index.html>.
+
2026-07-24 G. Branden Robinson <[email protected]>
[groff]: Regression-test Savannah #68552.
diff --git a/src/roff/troff/input.cpp b/src/roff/troff/input.cpp
index f63de35e5..6565be5bc 100644
--- a/src/roff/troff/input.cpp
+++ b/src/roff/troff/input.cpp
@@ -3146,10 +3146,9 @@ const char *token::description()
return "a newline";
case TOKEN_NODE:
{
- static char nodebuf[bufsz - (sizeof " token")];
- (void) strcpy(nodebuf, "an undescribed node");
- describe_node(nodebuf, bufsz);
- (void) snprintf(buf, bufsz, "%s token", nodebuf);
+ describe_node(buf, bufsz);
+ size_t len = strlen(buf);
+ (void) strncat(buf, " token", bufsz - len - 1 /* '\0' */);
return buf;
}
case TOKEN_INDEXED_CHAR:
_______________________________________________
groff-commit mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/groff-commit
