Bug#944297: htmltable.c:1761: pos_html_tbl: assertion delx >= 0, when using nested fixedsize table

[Witold Baryluk]

Package: graphviz
Version: 2.42.2-3
Severity: normal

Input is not fully sane, but it does crash dot:

$ dot -Tpng:cairo:cairo crashes_graphviz.dot 
Warning: cell size too small for content
dot: htmltable.c:1761: pos_html_tbl: Assertion `delx >= 0' failed.
Aborted
$

Somehow inimized file:

// dot -Tpng:cairo:cairo crashes_graphviz.dot
digraph stuff {
  green [shape=plaintext, label=<
<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0" WIDTH="192" HEIGHT="128">
  <TR>
    <TD WIDTH="40">
      <TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0" WIDTH="40" HEIGHT="128">
        <TR><TD PORT="inserter" WIDTH="40" HEIGHT="32" FIXEDSIZE="TRUE"> <TABLE 
BORDER="0" WIDTH="50" HEIGHT="32"><TR><TD WIDTH="8" HEIGHT="32">1</TD><TD 
WIDTH="32" HEIGHT="32"><IMG SRC="inserter.png" SCALE="TRUE"/></TD></TR></TABLE> 
</TD></TR>
      </TABLE>
    </TD>
  </TR>
</TABLE>
  >];
}



Also attached in attachment.

-- System Information:
Debian Release: bullseye/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'testing-debug'), (500, 
'unstable'), (1, 'experimental-debug'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.2.0-3-amd64 (SMP w/32 CPU cores)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, 
TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), 
LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages graphviz depends on:
ii  libann0        1.1.2+doc-7
ii  libc6          2.29-3
ii  libcdt5        2.42.2-3
ii  libcgraph6     2.42.2-3
ii  libexpat1      2.2.9-1
ii  libgcc1        1:9.2.1-17
ii  libgd3         2.2.5-5.2
ii  libglib2.0-0   2.62.2-2
ii  libgts-0.7-5   0.7.6+darcs121130-4+b1
ii  libgvc6        2.42.2-3
ii  libgvpr2       2.42.2-3
ii  liblab-gamut1  2.42.2-3
ii  libstdc++6     9.2.1-17
ii  libx11-6       2:1.6.8-1
ii  libxaw7        2:1.0.13-1+b2
ii  libxmu6        2:1.1.2-2+b3
ii  libxt6         1:1.1.5-1+b3

Versions of packages graphviz recommends:
ii  fonts-liberation  1:1.07.4-10

Versions of packages graphviz suggests:
pn  graphviz-doc  <none>
ii  gsfonts       1:8.11+urwcyr1.0.7~pre44-4.4

-- no debconf information

// dot -Tpng:cairo:cairo crashes_graphviz.dot
digraph stuff {
  green [shape=plaintext, label=<
<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0" WIDTH="192" HEIGHT="128">
  <TR>
    <TD WIDTH="40">
      <TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0" WIDTH="40" HEIGHT="128">
        <TR><TD PORT="inserter" WIDTH="40" HEIGHT="32" FIXEDSIZE="TRUE"> <TABLE 
BORDER="0" WIDTH="50" HEIGHT="32"><TR><TD WIDTH="8" HEIGHT="32">1</TD><TD 
WIDTH="32" HEIGHT="32"><IMG SRC="inserter.png" SCALE="TRUE"/></TD></TR></TABLE> 
</TD></TR>
      </TABLE>
    </TD>
  </TR>
</TABLE>
  >];
}