Re: A bug in MetaPost

--===============0527762964605358691==
Content-Type: multipart/alternative; boundary="0000000000005b60af0638e617b9"

--0000000000005b60af0638e617b9
Content-Type: text/plain; charset="UTF-8"

On Tue, 1 Jul 2025 at 19:46, Andreas Scherer <[email protected]> wrote:

>  > I found a bug in MetaPost. In source/texk/web2c/mplibdir/mpxout.w, on
>  > line 581, there is a single unescaped '%' that is fed to fprintf as
>  > the format string in line 645. This is UB by the C standard.
>
> In fact, there are two single unescaped '%'. They appear to be intended
> as TeX comment markers in '\gdef\mpxshipout{...}' and they should---just
> as '\\'---be doubled '%%' for the sake of the C compiler.
>
> The first '%' is redundant after '\bgroup', the second protects against
> spurious whitespace ('\n') after the closing curly brace. A similar '%%'
> should be added after '\\gdef\\stopmpxshipout{...}' in the same static
> string.
>
> Attached is a git-generated diff file that fixes these issues. It also
> makes MPXOUT.W formatting nicely with CWEAVE and pdfTeX. (Correctly
> distinguishing between type 'stat' in boldface and function 'stat' in
> italic is left for the interested reader as an exercise.)
>
>

commit 4f6430e05b03dccb794615106fe43ad17fa8d779 (HEAD -> main, origin/main,
origin/HEAD)
Author: Luigi Scarso <[email protected]>
Date:   Wed Jul 2 00:57:40 2025 +0200

    Fixed two single unescaped '%' in mpxout.w; makes MPXOUT.W formatting
nicely with CWEAVE and pdfTeX (A. Scherer)

--
luigi

--0000000000005b60af0638e617b9
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><img class=3D"gmail-ajT" src=3D"https://s=
sl.gstatic.com/ui/v1/icons/mail/images/cleardot.gif"></div><br><div class=
=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr=
">On Tue, 1 Jul 2025 at 19:46, Andreas Scherer &lt;<a href=3D"mailto:andrea=
[email protected]">[email protected]</a>&gt; wrote:<br></div><blockquot=
e class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px s=
olid rgb(204,204,204);padding-left:1ex">=C2=A0&gt; I found a bug in MetaPos=
t. In source/texk/web2c/mplibdir/mpxout.w, on<br>
=C2=A0&gt; line 581, there is a single unescaped &#39;%&#39; that is fed to=
 fprintf as<br>
=C2=A0&gt; the format string in line 645. This is UB by the C standard.<br>
<br>
In fact, there are two single unescaped &#39;%&#39;. They appear to be inte=
nded <br>
as TeX comment markers in &#39;\gdef\mpxshipout{...}&#39; and they should--=
-just <br>
as &#39;\\&#39;---be doubled &#39;%%&#39; for the sake of the C compiler.<b=
r>
<br>
The first &#39;%&#39; is redundant after &#39;\bgroup&#39;, the second prot=
ects against <br>
spurious whitespace (&#39;\n&#39;) after the closing curly brace. A similar=
 &#39;%%&#39; <br>
should be added after &#39;\\gdef\\stopmpxshipout{...}&#39; in the same sta=
tic <br>
string.<br>
<br>
Attached is a git-generated diff file that fixes these issues. It also <br>
makes MPXOUT.W formatting nicely with CWEAVE and pdfTeX. (Correctly <br>
distinguishing between type &#39;stat&#39; in boldface and function &#39;st=
at&#39; in <br>
italic is left for the interested reader as an exercise.)<br>
<br></blockquote><div><br></div><div><br></div><div>commit 4f6430e05b03dccb=
794615106fe43ad17fa8d779 (HEAD -&gt; main, origin/main, origin/HEAD)<br>Aut=
hor: Luigi Scarso &lt;<a href=3D"mailto:[email protected]">luigi.scars=
[email protected]</a>&gt;<br>Date: =C2=A0 Wed Jul 2 00:57:40 2025 +0200<br><br>=
=C2=A0 =C2=A0 Fixed two single unescaped &#39;%&#39; in mpxout.w; makes MPX=
OUT.W formatting nicely with CWEAVE and pdfTeX (A. Scherer)<br><br></div><d=
iv>--</div><div>luigi</div></div></div>

--0000000000005b60af0638e617b9--

--===============0527762964605358691==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

--
http://tug.org/metapost/

--===============0527762964605358691==--