[bug #68552] [PATCH] [troff] memory corruption in `token::description()` in `TOKEN_NODE` case

--8323329-424238335-1785110764=:2976030
Content-Type: TEXT/plain; CHARSET=utf-8
Content-Transfer-Encoding: QUOTED-PRINTABLE
Content-Disposition: inline

Update of bug #68552 (group groff):=0A=0A                  Status:         =
    In Progress =3D> Fixed=0A             Open/Closed:                    O=
pen =3D> Closed=0A=0A    __________________________________________________=
_____=0A=0AFollow-up Comment #6:=0A=0A=0Acommit 12f546f99a2ccc27156d117b5e2=
b9918010244ab=0AAuthor: G. Branden Robinson <[email protected]>=
=0ADate:   Sun Jul 26 00:21:00 2026 -0500=0A=0A    [groff]: Regression-test=
 Savannah #68552.=0A    =0A    * src/roff/groff/tests/error-grief-token-des=
criptions.sh: Do it.=0A    =0A    * src/roff/groff/groff.am (groff_TESTS): =
Run test.=0A    =0A    Test fails at this commit.=0A=0Acommit 0ebb2ba4af491=
99a99e391ff1f359219ede058d6=0AAuthor: G. Branden Robinson <g.branden.robins=
[email protected]>=0ADate:   Fri Jul 24 16:21:00 2026 -0500=0A=0A    [troff]: Fi=
x Savannah #68552.=0A    =0A    * src/roff/troff/input.cpp (token::descript=
ion): Simplify population of=0A      buffer describing a node token and avo=
id potentially overwriting a=0A      heap-allocated buffer if that node's d=
escription is lengthy (as=0A      "non-interpreted character nodes", input =
in *roff as `\a` and `\t`,=0A      are).  Discard stale code that uselessly=
 performed a dead store of a=0A      dummy node description; `describe_node=
()` zeroes out its destination=0A      buffer so that became pointless a wh=
ile back.  Then, simply measure=0A      the buffer as populated by `describ=
e_node()` with strlen(3) and append=0A      to it carefully with strncat(3)=
, respecting `bufsz`.=0A    =0A    Fixes <https://savannah.gnu.org/bugs/?68=
552>.  Thanks to Bruno Haible=0A    for the investigation and advice.  I be=
lieve I introduced this problem=0A    during the groff 1.24.0 development c=
ycle in the course of my "node tree=0A    dumping death march", but have no=
t tracked it down to a specific commit.=0A    See generally=0A    <https://=
lists.gnu.org/archive/html/groff-commit/2025-03/index.html>.=0A=0A=0A=0A=0A=
    _______________________________________________________=0A=0AReply to t=
his item at:=0A=0A  <https://savannah.gnu.org/bugs/?68552>=0A=0A___________=
____________________________________=0AMessage sent via Savannah=0Ahttps://=
savannah.gnu.org/=0A
--8323329-424238335-1785110764=:2976030
Content-Type: APPLICATION/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iHUEABYIAB0WIQQk97aszIMMAvLLwm6qLAuaBUf3TgUCamag7AAKCRCqLAuaBUf3
TpJVAP4yXzn6lglZ0x214F95Wm8xkp3Z3QEHXl2kvm5AxmqwrAD+NMIB/NNXGQfa
uaajMUTQcBCFF/CqFvsP2FKBAjJOOQY=
=UiIa
-----END PGP SIGNATURE-----

--8323329-424238335-1785110764=:2976030--