gbranden pushed a commit to branch master
in repository groff.
commit 9e7f0a9836535bc2e1d96073170ef0619ab5c4e1
Author: G. Branden Robinson <[email protected]>
AuthorDate: Fri Jul 24 02:30:16 2026 -0500
[troff]: Fix Savannah #68555.
* src/roff/troff/env.cpp (print_hyphenation_exceptions_request): When
the "phw-request-works.sh" test script ran under sufficiently
aggressive memory debugging, it failed. Fix 1-byte heap overread when
a hyphenation word supplied by a hyphenation exceptions word list
(contrast those defined by the `hw` request) has no hyphenation points
at all.
Fixes <https://savannah.gnu.org/bugs/?68555>. Problem introduced by me
in commit 0b40885e71, 2023-11-03.
---
ChangeLog | 12 ++++++++++++
src/roff/troff/env.cpp | 38 +++++++++++++++++++++++---------------
2 files changed, 35 insertions(+), 15 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index ca5978e0d..a6745c231 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,15 @@
+2026-07-24 G. Branden Robinson <[email protected]>
+
+ * src/roff/troff/env.cpp (print_hyphenation_exceptions_request):
+ When the "phw-request-works.sh" test script ran under
+ sufficiently aggressive memory debugging, it failed. Fix 1-byte
+ heap overread when a hyphenation word supplied by a hyphenation
+ exceptions word list (contrast those defined by the `hw`
+ request) has no hyphenation points at all.
+
+ Fixes <https://savannah.gnu.org/bugs/?68555>. Problem
+ introduced by me in commit 0b40885e71, 2023-11-03.
+
2026-07-21 G. Branden Robinson <[email protected]>
* configure.ac: Override GNU Autoconf [2.70,2.72]'s cramdowns of
diff --git a/src/roff/troff/env.cpp b/src/roff/troff/env.cpp
index 5b2cbaf7c..8f4542d89 100644
--- a/src/roff/troff/env.cpp
+++ b/src/roff/troff/env.cpp
@@ -4187,24 +4187,32 @@ static void print_hyphenation_exceptions_request() //
.phw
assert(hypoint != 0 /* nullptr */);
string word = entry.contents();
(void) memset(wordbuf, '\0', bufsz);
- size_t i = 0, j = 0, len = word.length();
- bool is_mode_dependent = false;
- while (i < len) {
- if ((hypoint != 0 /* nullptr */) && (*hypoint == i)) {
- wordbuf[j++] = '-';
- hypoint++;
- }
- // The exception word symbol's contents contains a space if it's
- // _not_ user-defined. See
- // `remove_hyphenation_exception_words_request()` above.
- if (word[i] == ' ') {
- assert(i == (len - 1));
- is_mode_dependent = true;
+ size_t len = word.length();
+ // It should be impossible by any means to populate the hyphenation
+ // exception word dictionary with an empty entry.
+ assert(len > 0);
+ if (0 == len) // NDEBUG
+ continue;
+ if (0 == *hypoint) {
+ // `word` has no hyphenation points.
+ (void) strncpy(wordbuf, word.contents(), len);
+ wordbuf[len] = '\0'; // `wordbuf` is _guaranteed_ to be > len long
+ }
+ else {
+ size_t i = 0, j = 0;
+ while (i < len) {
+ if ((hypoint != 0 /* nullptr */) && (*hypoint == i)) {
+ wordbuf[j++] = '-';
+ hypoint++;
+ }
+ wordbuf[j++] = word[i++];
}
- wordbuf[j++] = word[i++];
}
errprint("%1", wordbuf);
- if (is_mode_dependent)
+ // The exception word symbol's `contents` ends with a space if it's
+ // _not_ user-defined. See
+ // `remove_hyphenation_exception_words_request()` above.
+ if (word[len - 1] == ' ')
errprint("\t*");
errprint("\n");
}
_______________________________________________
groff-commit mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/groff-commit
