bugGNU roff - Bugs: bug #62366, [tbl] core dumps if repeating...

 
 

bug #62366: [tbl] core dumps if repeating character used in text block

Submitter:  G. Branden Robinson <gbranden>
Submitted:  Mon 25 Apr 2022 06:12:59 PM UTC
   
 
Category:  Preprocessor tbl Severity:  4 - Important
Item Group:  Crash/Unresponsive Status:  Fixed
Privacy:  Public Assigned to:  gbranden
Open/Closed:  Closed Planned Release:  1.23.0
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 26 Apr 2022 10:41:26 AM UTC, comment #2: 


commit 4f4b79b8aa0f044a3b2e6a97c8e7dd745b5eead9
Author: G. Branden Robinson <g.branden.robinson@gmail.com>
Date:   Tue Apr 26 18:04:32 2022 +1000

    [tbl]: Handle `\R` sequences in text blocks robustly.

    * src/preproc/tbl/table.cpp (table::add_entry): Fix SEGV when repeating
      glyph table entry syntax (`\Rx`) used in a text block.  Lift
      extraction of entry string to be done unconditionally, rather than in
      5 different special cases.  This frees us up to rewrite the entry if
      necessary, changing '\R' to '\&' inside a text block.  Recast
      diagnostic to describe the problem clearly--"bad repeated character"
      suggests that something is wrong with the "argument" to `\R`, when
      really the problem is the _context_.

    Fixes <http://savannah.gnu.org/bugs/?62366>.

commit 19b05a9d1b7f110429cf9df1f3d9d30873d019b2
Author: G. Branden Robinson <g.branden.robinson@gmail.com>
Date:   Tue Apr 26 18:02:08 2022 +1000

    [tbl]: Regression-test Savannah #62366.

    * src/preproc/tbl/tests/do-not-segv-when-backslash-R-in-text-block.sh:
      Do it.
    * src/preproc/tbl/tbl.am (tbl_TESTS): Run test.

    Test fails at this commit.

commit 36edfbadb0edf858d638cd2ed3c793566e545789
Author: G. Branden Robinson <g.branden.robinson@gmail.com>
Date:   Tue Apr 26 11:12:54 2022 +1000

    src/libs/libgroff/string.cpp: Check malloc return.

    * src/libs/libgroff/string.cpp (string::extract): Check return value of
      `malloc()` for nullity, and only poke into the buffer returned if it
      is valid.  Discovered while troubleshooting Savannah #62366.

    Also update editor aid comments; drop old-style Emacs file-local
    variable setting.


G. Branden Robinson <gbranden>
Group administrator
Tue 26 Apr 2022 08:08:46 AM UTC, comment #1: 

This seems to fix it.


diff --git a/ChangeLog b/ChangeLog
index ba4cf2198..236dd47ae 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -6,6 +6,22 @@
        do-not-segv-when-backslash-R-in-text-block.sh: Do it.
        * src/preproc/tbl/tbl.am (tbl_TESTS): Run test.

+2022-04-26  G. Branden Robinson <g.branden.robinson@gmail.com>
+
+       [tbl]: Handle `\R` sequences in text blocks robustly.
+
+       * src/preproc/tbl/table.cpp (table::add_entry): Fix SEGV when
+       repeating glyph table entry syntax (`\Rx`) used in a text block.
+       Lift extraction of entry string to be done unconditionally,
+       rather than in 5 different special cases.  This frees us up to
+       rewrite the entry if necessary, changing '\R' to '\&' inside a
+       text block.  Recast diagnostic to describe the problem
+       clearly--"bad repeated character" suggests that something is
+       wrong with the "argument" to `\R`, when really the problem is
+       the _context_.
+
+       Fixes <http://savannah.gnu.org/bugs/?62366>.
+
 2022-04-26  G. Branden Robinson <g.branden.robinson@gmail.com>

        * src/libs/libgroff/string.cpp (string::extract): Check return
diff --git a/src/preproc/tbl/table.cpp b/src/preproc/tbl/table.cpp
index 66a1c2b5a..18cee1e92 100644
--- a/src/preproc/tbl/table.cpp
+++ b/src/preproc/tbl/table.cpp
@@ -1508,6 +1508,18 @@ void table::add_entry(int r, int c, const string &str,
 {
   allocate(r);
   table_entry *e = 0;
+  char *s = str.extract();
+  if (str.search('\n') >= 0) {
+    bool was_changed = false;
+    for (int i = 0; s[i] != '\0'; i++)
+      if ((i > 0) && (s[(i - 1)] == '\\') && (s[i] == 'R')) {
+       s[i] = '&';
+       was_changed = true;
+      }
+    if (was_changed)
+      error_with_file_and_line(fn, ln, "repeating a glyph with '\\R'"
+                              " is not allowed in a text block");
+  }
   if (str == "\\_") {
     e = new short_line_entry(this, f);
   }
@@ -1546,17 +1558,8 @@ void table::add_entry(int r, int c, const string &str,
     else
       do_vspan(r, c);
   }
-  else if (str.length() > 2 && str[0] == '\\' && str[1] == 'R') {
-    if (str.search('\n') >= 0)
-      error_with_file_and_line(fn, ln, "bad repeated character");
-    else {
-      char *s = str.substring(2, str.length() - 2).extract();
-      e = new repeated_char_entry(this, f, s);
-    }
-  }
   else {
     int is_block = str.search('\n') >= 0;
-    char *s;
     switch (f->type) {
     case FORMAT_SPAN:
       assert(str.empty());
@@ -1564,7 +1567,6 @@ void table::add_entry(int r, int c, const string &str,
       break;
     case FORMAT_LEFT:
       if (!str.empty()) {
-       s = str.extract();
        if (is_block)
          e = new left_block_entry(this, f, s);
        else
@@ -1575,7 +1577,6 @@ void table::add_entry(int r, int c, const string &str,
       break;
     case FORMAT_CENTER:
       if (!str.empty()) {
-       s = str.extract();
        if (is_block)
          e = new center_block_entry(this, f, s);
        else
@@ -1586,7 +1587,6 @@ void table::add_entry(int r, int c, const string &str,
       break;
     case FORMAT_RIGHT:
       if (!str.empty()) {
-       s = str.extract();
        if (is_block)
          e = new right_block_entry(this, f, s);
        else
@@ -1597,7 +1597,6 @@ void table::add_entry(int r, int c, const string &str,
       break;
     case FORMAT_NUMERIC:
       if (!str.empty()) {
-       s = str.extract();
        if (is_block) {
          error_with_file_and_line(fn, ln, "can't have numeric text block");
          e = new left_block_entry(this, f, s);
@@ -1615,7 +1614,6 @@ void table::add_entry(int r, int c, const string &str,
       break;
     case FORMAT_ALPHABETIC:
       if (!str.empty()) {
-       s = str.extract();
        if (is_block)
          e = new alphabetic_block_entry(this, f, s);
        else


G. Branden Robinson <gbranden>
Group administrator
Mon 25 Apr 2022 06:12:59 PM UTC, original submission:  

tbl tries to catch this situation, but doesn't bail out cleanly enough.  Affects groff 1.22.4.


$ cat EXPERIMENTS/bad-repeated-character.roff
.TS
L.
T{
\Ra
T}
.TE
$ tbl EXPERIMENTS/bad-repeated-character.roff >/dev/null
tbl:EXPERIMENTS/bad-repeated-character.roff:4: bad repeated character
Segmentation fault (core dumped)


G. Branden Robinson <gbranden>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gbranden (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-06-15 gbranden Item GroupNone Crash/Unresponsive
    2022-04-26 gbranden StatusIn Progress Fixed
        Open/ClosedOpen Closed
        Planned ReleaseNone 1.23.0
    2022-04-26 gbranden StatusConfirmed In Progress

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code