Follow-up Comment #7, bug #68552 (group groff): I later tracked down the troublesome commit, but made a typo so I revised the ChangeLog entry yet again.
Here's how it reads now. 2026-07-24 G. Branden Robinson <[email protected]> [troff]: Fix Savannah #68552. * src/roff/troff/input.cpp (token::description): Simplify population of buffer describing a node token and avoid potentially overwriting a heap-allocated buffer if that node's description is lengthy (as "non-interpreted character nodes", input in *roff as `\a` and `\t`, are). Discard stale code that performed a dead store of a dummy node description; `describe_node()` zeroes out its destination buffer, so that became pointless a while back. Then, simply measure the buffer as populated by `describe_node()` with strlen(3) and append to it carefully with strncat(3), respecting `bufsz`. Fixes <https://savannah.gnu.org/bugs/?68552>. Thanks to Bruno Haible for the investigation and advice. Problem apparently introduced by me in commit dd7bf97938, 23 November, but in the instance for which we have a reproducer, this heap overwrite was not reached because it was masked by a prior null pointer dereference (in `lookup_request()`, which was set up to fail by `do_request()`; see Savannah #68558). _______________________________________________________ Reply to this item at: <https://savannah.gnu.org/bugs/?68552> _______________________________________________ Message sent via Savannah https://savannah.gnu.org/
signature.asc
Description: PGP signature
