gbranden pushed a commit to branch master
in repository groff.
commit bd0f127eda62e5ec4d56dcea5856d881bb4cfdfe
Author: G. Branden Robinson <[email protected]>
AuthorDate: Sat Oct 3 16:09:31 2026 -0500
[grn]: Fix Savannah #68686.
* src/preproc/grn/hgraph.cpp: Preprocessor-include "errarg.h" and
"error.h" headers so that libgroff's `fatal()` function is visible.
(drawwig): Add check of static value `MAXPOINTS` limiting the quantity
of a curve's control points. Exceeding the limit is a fatal error.
* src/preproc/grn/grn.1.man (Exit status): Document that command may
exit with status 3--that's what `fatal()` does.
Fixes <https://savannah.gnu.org/bugs/?68686>. Thanks to Pavol Sloboda
for the report and a reproducer. Problem appears to date back
"forever"; groff imported a C++-ported version of grn in commit
a75cf74b60, 2000-02-20. While the original C code from "Berkeley
ditroff" is hard to track down, it appears likely that the defect was
present there, too. Taking the SCCS what(1) information in the "last
non-groff version" comment at face value would push the date of the
defect back to 1984-11-27, and it might be older still.
---
ChangeLog | 23 +++++++++++++++++++++++
src/preproc/grn/grn.1.man | 4 +++-
src/preproc/grn/hgraph.cpp | 6 ++++++
3 files changed, 32 insertions(+), 1 deletion(-)
diff --git a/ChangeLog b/ChangeLog
index 2e3be0e0f..7e2a24a85 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,26 @@
+2026-10-03 G. Branden Robinson <[email protected]>
+
+ [grn]: Fix Savannah #68686.
+
+ * src/preproc/grn/hgraph.cpp: Preprocessor-include "errarg.h"
+ and "error.h" headers so that libgroff's `fatal()` function is
+ visible.
+ (drawwig): Add check of static value `MAXPOINTS` limiting the
+ quantity of a curve's control points. Exceeding the limit is a
+ fatal error.
+ * src/preproc/grn/grn.1.man (Exit status): Document that command
+ may exit with status 3--that's what `fatal()` does.
+
+ Fixes <https://savannah.gnu.org/bugs/?68686>. Thanks to Pavol
+ Sloboda for the report and a reproducer. Problem appears to
+ date back "forever"; groff imported a C++-ported version of grn
+ in commit a75cf74b60, 2000-02-20. While the original C code
+ from "Berkeley ditroff" is hard to track down, it appears likely
+ that the defect was present there, too. Taking the SCCS what(1)
+ information in the "last non-groff version" comment at face
+ value would push the date of the defect back to 1984-11-27, and
+ it might be older still.
+
2026-10-03 G. Branden Robinson <[email protected]>
[grn]: Regression-test Savannah #68686.
diff --git a/src/preproc/grn/grn.1.man b/src/preproc/grn/grn.1.man
index 1d11793af..79e2d4248 100644
--- a/src/preproc/grn/grn.1.man
+++ b/src/preproc/grn/grn.1.man
@@ -975,7 +975,9 @@ on successful operation,
.RB status\~ 2
if the program cannot interpret its command-line arguments,
and
-.RB status\~ 1
+.RB status\~ 1 \" produced by "legacy" error handling
+or
+.B 3 \" produced by `fatal()`
if it encounters an error during operation.
.
.
diff --git a/src/preproc/grn/hgraph.cpp b/src/preproc/grn/hgraph.cpp
index 5c60ae938..9e409e24e 100644
--- a/src/preproc/grn/hgraph.cpp
+++ b/src/preproc/grn/hgraph.cpp
@@ -14,6 +14,8 @@
#include <config.h>
#endif
+#include "errarg.h" // prerequisite of "error.h"
+#include "error.h" // fatal()
#include "lib.h"
#include "gprint.h"
@@ -566,7 +568,11 @@ drawwig(POINT * ptr,
int npts; /* point list index */
int x[MAXPOINTS], y[MAXPOINTS]; /* point list */
+ // Note the non-idiomatic 1-based array indexing.
for (npts = 1; !Nullpoint(ptr); ptr = PTNextPoint(ptr), npts++) {
+ if (npts >= MAXPOINTS) // `>=` due to 1-based array
+ fatal("cannot draw curve with %1 or more control points",
+ MAXPOINTS);
x[npts] = (int) (ptr->x * troffscale);
y[npts] = (int) (ptr->y * troffscale);
}
_______________________________________________
groff-commit mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/groff-commit
