pic crashes if macro has more than nine arguments

[Jennifer Sayers]

Dear Werner,

I was doing a big complicated picture when I got an error message like
this:

        *** glibc detected *** malloc(): memory corruption: 0x094a87d8 ***
        groff: pic: Signal 6

I investigated and found that GNU pic crashes if I invoke a macro with
more than nine arguments:

******************************************************************************

$ groff -v
GNU groff version 1.19.3
Copyright (C) 2005 Free Software Foundation, Inc.
GNU groff comes with ABSOLUTELY NO WARRANTY.
You may redistribute copies of groff and its subprograms
under the terms of the GNU General Public License.
For more information about these matters, see the file named COPYING.

called subprograms:

GNU grops (groff) version 1.19.3
GNU troff (groff) version 1.19.3
$ 
$ cat ok.pic
.PS
define mymacro {}
mymacro(1, 2, 3, 4, 5, 6, 7, 8, 9)
.PE
$ 
$ pic ok.pic
.lf 1 ok.pic
.lf 1
.lf 5
$ 
$ cat bug.pic
.PS
define mymacro {}
mymacro(1, 2, 3, 4, 5, 6, 7, 8, 9, 10)
.PE
$ 
$ pic bug.pic
.lf 1 bug.pic
.lf 1
Segmentation fault

******************************************************************************

I started to wonder about the semantics of "$10", so I extended my
example a little and put it into DWB pic.

DWB pic doesn't crash, and understands "$10" as the tenth argument:

******************************************************************************

$ cat tenbox.pic
.PS
define mymacro {
        box $10
}
mymacro(1, 2, 3, 4, 5, 6, 7, 8, 9, "tenth argument")
.PE
$ 
$ /opt/dwb/bin/pic tenbox.pic
.lf 1 tenbox.pic
... 0 -0.25 0.75 0.25
... 0.000i 0.500i 0.750i 0.000i
.nr 00 \n(.u
.nf
.PS 0.500i 0.750i 
.lf 7
\v'0.500i'\D'l0.000i -0.500i'
.sp -1
\D'l0.750i 0.000i'
.sp -1
\h'0.750i'\D'l0.000i 0.500i'
.sp -1
\h'0.750i'\v'0.500i'\D'l-0.750i 0.000i'
.sp -1
\h'0.375i'\v'0.250i'\v'.2m'\h'-\w'tenth argument'u/2u'tenth argument
.sp -1
.sp 1+0.500i
.PE
.if \n(00 .fi
.lf 7

*****************************************************************************

This shows that things like $10, $11, etc. are supposed to work in pic
(unlike the Bourne shell).

I have a very old GNU pic on another machine (version 1.09), so I tried
the "text in the box" example on it.  That one doesn't crash, but I get
no text in the box, so I'm not sure what it thinks it's doing with $10.
It's running on another operating system, so this may be another
manifestation of the same bug.  Maybe the bug is very old.

Thanks,

jen.