[groff] 15/15: [tbl]: Fix integer overflow of groff register.

[G. Branden Robinson]

gbranden pushed a commit to branch master
in repository groff.

commit 49a2c2cab0bbed2f3278a368a2e5d9d593dfc7a9
Author: G. Branden Robinson <g.branden.robinson@gmail.com>
AuthorDate: Wed Feb 3 17:17:33 2021 +1100

    [tbl]: Fix integer overflow of groff register.
    
    * src/preproc/tbl/table.cpp (table::init_output): Save value of
      hyphenation maximum consecutive line count register (\n[.hlm]) more
      carefully to keep it from being incorrectly parsed as a decrement,
      because negative values of \n[.hlm] are valid (in fact, "-1" is the
      default).  In documents with a large number of tables, this can lead
      to a Persian chessboard problem and an integer overflow (at the groff
      language level, caught and handled by
      src/roff/troff/number.cpp:parse_term()).
    
      It is wise to wrap a non-literal second argument to the .nr request in
      parentheses if assignment is desired and its value can be negative.
      See section 5.6.1 ("Setting Registers") of the groff Texinfo manual.
    
    Fixes <https://savannah.gnu.org/bugs/?59993>.
    
    Problem introduced by me in commit
    cee547e8839a82f8b21b2859a9370fd74f9793f3 on 30 January.
---
 ChangeLog                 | 18 ++++++++++++++++++
 src/preproc/tbl/table.cpp |  2 +-
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 60b0dd1..6af4286 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,23 @@
 2021-02-03  G. Branden Robinson <g.branden.robinson@gmail.com>
 
+       * src/preproc/tbl/table.cpp (table::init_output): Save value of
+       hyphenation maximum consecutive line count register (\n[.hlm])
+       more carefully to keep it from being incorrectly parsed as a
+       decrement, because negative values of \n[.hlm] are valid (in
+       fact, "-1" is the default).  In documents with a large number of
+       tables, this can lead to a Persian chessboard problem and an
+       integer overflow (at the groff language level, caught and
+       handled by src/roff/troff/number.cpp:parse_term()).
+
+       It is wise to wrap a non-literal second argument to the .nr
+       request in parentheses if assignment is desired and its value
+       can be negative.  See section 5.6.1 ("Setting Registers") of the
+       groff Texinfo manual.
+
+       Fixes <https://savannah.gnu.org/bugs/?59993>.
+
+2021-02-03  G. Branden Robinson <g.branden.robinson@gmail.com>
+
        [rfc1345]: Add smoke test.
 
        * contrib/rfc1345/tests/rfc1345-smoke-test.sh: Add test.
diff --git a/src/preproc/tbl/table.cpp b/src/preproc/tbl/table.cpp
index 8c83c7f..4eb5841 100644
--- a/src/preproc/tbl/table.cpp
+++ b/src/preproc/tbl/table.cpp
@@ -1794,7 +1794,7 @@ void table::init_output()
         ".ds " SAVED_TABS_NAME " \\n[.tabs]\n"
         ".nr " SAVED_HYPHENATION_MODE_REG " \\n[.hy]\n"
         ".ds " SAVED_HYPHENATION_LANG_NAME " \\n[.hla]\n"
-        ".nr " SAVED_HYPHENATION_MAX_LINES_REG " \\n[.hlm]\n"
+        ".nr " SAVED_HYPHENATION_MAX_LINES_REG " (\\n[.hlm])\n"
         ".nr " SAVED_HYPHENATION_MARGIN_REG " \\n[.hym]\n"
         ".nr " SAVED_HYPHENATION_SPACE_REG " \\n[.hys]\n"
         ".nr T. 0\n"