[bug #56555] I can make grops and grotty core dump with 5 bytes of input

[G. Branden Robinson]

Update of bug #56555 (project groff):

                  Status:                    None => Ready For Test         
             Assigned to:                    None => gbranden               

    _______________________________________________________

Follow-up Comment #4:

This seems to be a bog-standard instance of calling functions that can return
errors and then not checking for errors.

A fix is attached.  Please code-review.

Although the problem is in libdriver, I went ahead and tested the fix on every
output driver that calls set_char(), and got satisfactory results (complaint,
but no crash):


$ grep -lrw 'set_char' src
src/include/printer.h
src/libs/libdriver/printer.cpp
src/devices/grolj4/lj4.cpp
src/devices/grotty/tty.cpp
src/devices/grolbp/lbp.cpp
src/devices/grohtml/post-html.cpp
src/devices/grodvi/dvi.cpp
src/devices/grops/ps.cpp

$ for DEV in lj4 utf8 ascii lbp html dvi ps; do ./build/test-groff -T$DEV
./crash.nroff >/dev/null || echo driver $DEV failed with exit status $?; done
grolj4:<standard input>:5: bad font position '-1'
grotty:<standard input>:5: bad font position '-1'
grotty:<standard input>:5: bad font position '-1'
grolbp:<standard input>:5: bad font position '-1'
grops:<standard input> (././crash.nroff):6: bad font position '-1'
post-grohtml:<standard input> (././crash.nroff):26: bad font position '-1'
grodvi:<standard input>:5: bad font position '-1'
grops:<standard input>:5: bad font position '-1'


    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?56555>

_______________________________________________
  Message sent via Savannah
  https://savannah.gnu.org/