[groff] 11/27: [troff]: Validate `ftr` request arguments.

[G. Branden Robinson]

gbranden pushed a commit to branch master
in repository groff.

commit ddfc1b70453a4ae854129e6e4b8fa9f4b832d8b3
Author: G. Branden Robinson <g.branden.robinson@gmail.com>
AuthorDate: Sun Aug 27 11:55:20 2023 -0500

    [troff]: Validate `ftr` request arguments.
    
    * src/roff/troff/node.cpp (translate_font): Validate arguments.
---
 ChangeLog               |  4 ++++
 src/roff/troff/node.cpp | 28 ++++++++++++++++++++++------
 2 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 00ea9ab99..713cdc7f5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2023-08-27  G. Branden Robinson <g.branden.robinson@gmail.com>
+
+       * src/roff/troff/node.cpp (translate_font): Validate arguments.
+
 2023-08-27  G. Branden Robinson <g.branden.robinson@gmail.com>
 
        [troff]: Trivially refactor; add utility function.
diff --git a/src/roff/troff/node.cpp b/src/roff/troff/node.cpp
index dd2ea79bc..135e207fc 100644
--- a/src/roff/troff/node.cpp
+++ b/src/roff/troff/node.cpp
@@ -6035,14 +6035,30 @@ static bool is_nonnegative_integer(const char *str)
 
 static void translate_font()
 {
+  if (!(has_arg())) {
+    warning(WARN_MISSING, "one or two font names expected in font"
+           " translation request");
+    skip_line();
+    return;
+  }
   symbol from = get_name(true /* required */);
-  if (!from.is_null()) {
-    symbol to = get_name();
-    if (to.is_null() || from == to)
-      font_translation_dictionary.remove(from);
-    else
-      (void)font_translation_dictionary.lookup(from, (void *)to.contents());
+  assert(!from.is_null()); // has_arg() should ensure this
+  if (is_nonnegative_integer(from.contents())) {
+    error("cannot translate a font mounting position");
+    skip_line();
+    return;
   }
+  symbol to = get_name();
+  if ((!to.is_null()) && is_nonnegative_integer(to.contents())) {
+    error("cannot translate to a font mounting position");
+    skip_line();
+    return;
+  }
+  if (to.is_null() || from == to)
+    font_translation_dictionary.remove(from);
+  else
+    (void) font_translation_dictionary.lookup(from,
+                                             (void *)to.contents());
   skip_line();
 }