[bug #68552] [PATCH] [troff] memory corruption in `token::description()` in `TOKEN_NODE` case
"G. Branden Robinson" <[email protected]> Fri, 24 Jul 2026 21:43:33 -0400 (EDT)
| Newsgroups | gmane.comp.printing.groff.bugs |
|---|---|
| Message-ID | <[email protected]> |
--8323329-424238335-1784943813=:2069099 Content-Type: TEXT/plain; CHARSET=utf-8 Content-Transfer-Encoding: QUOTED-PRINTABLE Content-Disposition: inline Update of bug #68552 (group groff):=0A=0A Summary: [troff] = memory corruption in `token::description()`=0Ain `TOKEN_NODE` case =3D> [PA= TCH] [troff] memory corruption in=0A`token::description()` in `TOKEN_NODE` = case=0A=0A _______________________________________________________=0A=0A= Follow-up Comment #5:=0A=0AI believe I have a fix.=0A=0A=0Adiff --git a/Cha= ngeLog b/ChangeLog=0Aindex 2b5eab007..03b96bb08 100644=0A--- a/ChangeLog=0A= +++ b/ChangeLog=0A@@ -1,3 +1,25 @@=0A+2026-07-24 G. Branden Robinson <g.br= [email protected]>=0A+=0A+ [troff]: Fix Savannah #68552.=0A+= =0A+ * src/roff/troff/input.cpp (token::description): Simplify=0A+ = population of buffer describing a node token and avoid=0A+ potent= ially overwriting a heap-allocated buffer if that node's=0A+ descript= ion is lengthy (as "non-interpreted character nodes",=0A+ input in *r= off as `\a` and `\t`, are). Discard stale code that=0A+ uselessly pe= rformed a dead store of a dummy node description;=0A+ `describe_node(= )` zeroes out its destination buffer so that=0A+ became pointless a w= hile back. Then, simply measure the buffer=0A+ as populated by `desc= ribe_node()` with strlen(3) and append to=0A+ it carefully with strnc= at(3), respecting `bufsz`.=0A+=0A+ Fixes <https://savannah.gnu.org/bu= gs/?68558>. I believe I=0A+ introduced this problem during the groff= 1.24.0 development=0A+ cycle in the course of my "node tree dumping = death march", but=0A+ have not tracked it down to a specific commit. = See generally=0A+ <https://lists.gnu.org/archive/html/groff-commit/2= 025-03/\=0A+ index.html>.=0A+=0A 2026-07-24 G. Branden Robinson <g.b= [email protected]>=0A =0A [groff]: Regression-test Savannah = #68552.=0Adiff --git a/src/roff/troff/input.cpp b/src/roff/troff/input.cpp= =0Aindex f63de35e5..6565be5bc 100644=0A--- a/src/roff/troff/input.cpp=0A+++= b/src/roff/troff/input.cpp=0A@@ -3146,10 +3146,9 @@ const char *token::des= cription()=0A return "a newline";=0A case TOKEN_NODE:=0A {=0A- = static char nodebuf[bufsz - (sizeof " token")];=0A- (void) strcpy(n= odebuf, "an undescribed node");=0A- describe_node(nodebuf, bufsz);=0A-= (void) snprintf(buf, bufsz, "%s token", nodebuf);=0A+ describe_n= ode(buf, bufsz);=0A+ size_t len =3D strlen(buf);=0A+ (void) strnc= at(buf, " token", bufsz - len - 1 /* '\0' */);=0A return buf;=0A = }=0A case TOKEN_INDEXED_CHAR:=0A=0A=0A=0A=0A _________________________= ______________________________=0A=0AReply to this item at:=0A=0A <https://= savannah.gnu.org/bugs/?68552>=0A=0A________________________________________= _______=0AMessage sent via Savannah=0Ahttps://savannah.gnu.org/=0A --8323329-424238335-1784943813=:2069099 Content-Type: APPLICATION/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQQk97aszIMMAvLLwm6qLAuaBUf3TgUCamQUxQAKCRCqLAuaBUf3 TnABAQDvA+4yV29/ihS2yxrvi4YPs9Dgoh9tg0gHnmNkgjI/sQEAp1q6lACuBczs TlINQzpXvS2QwSFxspKCDey0dt6dXgA= =HJsz -----END PGP SIGNATURE----- --8323329-424238335-1784943813=:2069099--