bugGNU roff - Bugs: bug #61417, [tbl] core dump when further...

 
 

bug #61417: [tbl] core dump when further spanning a first-row (invalid) downward span

Submitter:  G. Branden Robinson <gbranden>
Submitted:  Tue 02 Nov 2021 06:08:08 PM UTC
   
 
Category:  Preprocessor tbl Severity:  4 - Important
Item Group:  Crash/Unresponsive Status:  Fixed
Privacy:  Public Assigned to:  gbranden
Open/Closed:  Closed Planned Release:  1.23.0
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 06 Nov 2021 05:39:48 AM UTC, comment #2: 


commit 2944e475dc087465126dfc32cfaaf3f803d0e0c0
Author: G. Branden Robinson <g.branden.robinson@gmail.com>
Date:   Thu Nov 4 05:26:40 2021 +1100

    [tbl]: Fix Savannah #61417.

    * src/preproc/tbl/table.cpp (table::add_entry): If we see a '\^' entry
      on the first row of a table, it's invalid, but we need to create an
      empty entry in its place.  Otherwise, someone can put another '\^'
      right below the one on the first row, creating a reference to a
      nonexistent table entry and provoking a SEGV.  Issue an error
      diagnostic (distinct from the one in `do_vspan()`), create the entry,
      and skip `do_vspan()` (given a '^' in a first-row definition, it
      issues an error diagnostic and returns early, which suffices).
      Problem appears to date back to groff 1.02 (June 1991) at the latest.

    Fixes <https://savannah.gnu.org/bugs/?61417>.


G. Branden Robinson <gbranden>
Group administrator
Wed 03 Nov 2021 06:00:59 PM UTC, comment #1: 

Proposed patch.

This was plainly an oversight in the original implementation; dealing with an invalid vertical span while reading a table format specification is a different beast than dealing with it while reading table data--you have to do something with the place where the entry should go.  Happily, I don't even have to give up on the table.


diff --git a/src/preproc/tbl/table.cpp b/src/preproc/tbl/table.cpp
index 11950f1de..06774b899 100644
--- a/src/preproc/tbl/table.cpp
+++ b/src/preproc/tbl/table.cpp
@@ -1534,7 +1534,12 @@ void table::add_entry(int r, int c, const string &str,
       e = new double_line_entry(this, f);
   }
   else if (str == "\\^") {
-    do_vspan(r, c);
+    if (r == 0) {
+      error("first row cannot contain a vertical span entry '\\^'");
+      e = new empty_entry(this, f);
+    }
+    else
+      do_vspan(r, c);
   }
   else if (str.length() > 2 && str[0] == '\\' && str[1] == 'R') {
     if (str.search('\n') >= 0)


GNU tbl soldiers on nicely now.


$ cat EXPERIMENTS/table-span-down.ms
.LP
.TS
l l l.
foo     \^      bar
baz     \^      qux
.TE
$ tgu -t -ms EXPERIMENTS/table-span-down.ms | cat -s
tbl:EXPERIMENTS/table-span-down.ms:4: error: first row cannot contain a vertical span entry '\^'

foo       bar
baz       qux


G. Branden Robinson <gbranden>
Group administrator
Tue 02 Nov 2021 06:08:08 PM UTC, original submission:  

Input:


$ cat EXPERIMENTS/table-span-down.roff
.TS
l.
\^
\^
.TE


Result with tbl from groff 1.22.4:


$ tbl EXPERIMENTS/table-span-down.roff >/dev/null
tbl:EXPERIMENTS/table-span-down.roff:4: first row cannot be vertically spanned
Segmentation fault (core dumped)


G. Branden Robinson <gbranden>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gbranden (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-11-06 gbranden StatusIn Progress Fixed
        Open/ClosedOpen Closed
        Planned ReleaseNone 1.23.0
    2021-11-03 gbranden StatusNone In Progress
        Assigned toNone gbranden

    Back to the top

    Powered by Savane 3.13-3230.
    Corresponding source code