gbranden pushed a commit to branch master
in repository groff.
commit 7c656f0f2e94588c03f2fed6bdf3be19a3e75231
Author: G. Branden Robinson <[email protected]>
AuthorDate: Sat Sep 19 02:59:48 2026 -0500
[eqn]: Fix Savannah #68683.
* src/preproc/eqn/box.cpp (set_param): Fix off-by-one error in loop
bounds leading to 1-byte heap overread diagnosed by ASAN.
Fixes <https://savannah.gnu.org/bugs/?68683>. Thanks to Pavol Sloboda
for the report. Problem introduced in commit 81bf236e4a, 2025-12-07.
---
ChangeLog | 9 +++++++++
src/preproc/eqn/box.cpp | 2 +-
2 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/ChangeLog b/ChangeLog
index 307ada92f..49ad39f10 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2026-09-19 G. Branden Robinson <[email protected]>
+
+ * src/preproc/eqn/box.cpp (set_param): Fix off-by-one error in
+ loop bounds leading to 1-byte heap overread diagnosed by ASAN.
+
+ Fixes <https://savannah.gnu.org/bugs/?68683>. Thanks to Pavol
+ Sloboda for the report. Problem introduced in commit
+ 81bf236e4a, 2025-12-07.
+
2026-09-19 G. Branden Robinson <[email protected]>
[eqn]: Regression-test Savannah #68707.
diff --git a/src/preproc/eqn/box.cpp b/src/preproc/eqn/box.cpp
index 95a6139ee..72678806c 100644
--- a/src/preproc/eqn/box.cpp
+++ b/src/preproc/eqn/box.cpp
@@ -142,7 +142,7 @@ struct param *param_table = 0 /* nullptr */;
void set_param(const char *name, int value)
{
- for (size_t i = 0; i <= countof(default_param_table); i++)
+ for (size_t i = 0; i < countof(default_param_table); i++)
if (strcmp(param_table[i].name, name) == 0) {
*(param_table[i].ptr) = value;
return;
_______________________________________________
groff-commit mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/groff-commit
