[bug #68555] [PATCH] [troff] ASAN runtime error: 1-byte heap overread in `print_hyphenation_exceptions_request()`

--8323329-1714636915-1784879974=:2850871
Content-Type: TEXT/plain; CHARSET=utf-8
Content-Transfer-Encoding: QUOTED-PRINTABLE
Content-Disposition: inline

Follow-up Comment #2, bug #68555 (group groff):=0A=0AMy initial patch was i=
nsufficient to preserve functionality.=0A=0AHere's a better one.=0A=0A=0Adi=
ff --git a/src/roff/troff/env.cpp b/src/roff/troff/env.cpp=0Aindex 6387be2d=
0..f75ab194c 100644=0A--- a/src/roff/troff/env.cpp=0A+++ b/src/roff/troff/e=
nv.cpp=0A@@ -4188,25 +4188,25 @@ static void print_hyphenation_exceptions_r=
equest() //=0A.phw=0A     string word =3D entry.contents();=0A     (void) m=
emset(wordbuf, '\0', bufsz);=0A     size_t i =3D 0, j =3D 0, len =3D word.l=
ength();=0A-    bool is_mode_dependent =3D false;=0A-    if (*hypoint !=3D =
0) {=0A+    if (0 =3D=3D *hypoint) {=0A+      // `word` has no hyphenation =
points.=0A+      (void) strncpy(wordbuf, word.contents(), len);=0A+      wo=
rdbuf[len] =3D '\0';=0A+    }=0A+    else {=0A       while (i < len) {=0A  =
      if ((hypoint !=3D 0 /* nullptr */) && (*hypoint =3D=3D i)) {=0A      =
    wordbuf[j++] =3D '-';=0A          hypoint++;=0A        }=0A-       // T=
he exception word symbol's contents contains a space if it's=0A-       // _=
not_ user-defined.  See=0A-       // `remove_hyphenation_exception_words_re=
quest()` above.=0A-       if (word[i] =3D=3D ' ') {=0A-         assert(i =
=3D=3D (len - 1));=0A-         is_mode_dependent =3D true;=0A-       }=0A  =
      wordbuf[j++] =3D word[i++];=0A       }=0A     }=0A     errprint("%1",=
 wordbuf);=0A-    if (is_mode_dependent)=0A+    // The exception word symbo=
l's contents contains a space if it's=0A+    // _not_ user-defined.  See=0A=
+    // `remove_hyphenation_exception_words_request()` above.=0A+    if (wo=
rd[len - 1] =3D=3D ' ')=0A       errprint("\t*");=0A     errprint("\n");=0A=
   }=0A=0A=0A=0A=0A    ____________________________________________________=
___=0A=0AReply to this item at:=0A=0A  <https://savannah.gnu.org/bugs/?6855=
5>=0A=0A_______________________________________________=0AMessage sent via =
Savannah=0Ahttps://savannah.gnu.org/=0A
--8323329-1714636915-1784879974=:2850871
Content-Type: APPLICATION/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iHUEABYIAB0WIQQk97aszIMMAvLLwm6qLAuaBUf3TgUCamMbZgAKCRCqLAuaBUf3
TrBeAQDpki2JxGgY6tqTPAIEdwwRch1TBm9ZEC5Jp4LCr/m+/gEAuiHbgwEBPZhI
MjK80G8d09tZwQLKL2uzEcr/CTvcOgs=
=mTeI
-----END PGP SIGNATURE-----

--8323329-1714636915-1784879974=:2850871--