[groff] 04/16: [tbl]: Fix Savannah #61417.

[G. Branden Robinson]

gbranden pushed a commit to branch master
in repository groff.

commit 2944e475dc087465126dfc32cfaaf3f803d0e0c0
Author: G. Branden Robinson <g.branden.robinson@gmail.com>
AuthorDate: Thu Nov 4 05:26:40 2021 +1100

    [tbl]: Fix Savannah #61417.
    
    * src/preproc/tbl/table.cpp (table::add_entry): If we see a '\^' entry
      on the first row of a table, it's invalid, but we need to create an
      empty entry in its place.  Otherwise, someone can put another '\^'
      right below the one on the first row, creating a reference to a
      nonexistent table entry and provoking a SEGV.  Issue an error
      diagnostic (distinct from the one in `do_vspan()`), create the entry,
      and skip `do_vspan()` (given a '^' in a first-row definition, it
      issues an error diagnostic and returns early, which suffices).
      Problem appears to date back to groff 1.02 (June 1991) at the latest.
    
    Fixes <https://savannah.gnu.org/bugs/?61417>.
---
 ChangeLog                 | 15 +++++++++++++++
 src/preproc/tbl/table.cpp |  7 ++++++-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index cf4e515..5af64d3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,20 @@
 2021-11-04  G. Branden Robinson <g.branden.robinson@gmail.com>
 
+       * src/preproc/tbl/table.cpp (table::add_entry): If we see a '\^'
+       entry on the first row of a table, it's invalid, but we need to
+       create an empty entry in its place.  Otherwise, someone can put
+       another '\^' right below the one on the first row, creating a
+       reference to a nonexistent table entry and provoking a SEGV.
+       Issue an error diagnostic (distinct from the one in
+       `do_vspan()`), create the entry, and skip `do_vspan()` (given a
+       '^' in a first-row definition, it issues an error diagnostic and
+       returns early, which suffices).  Problem appears to date back to
+       groff 1.02 (June 1991) at the latest.
+
+       Fixes <https://savannah.gnu.org/bugs/?61417>.
+
+2021-11-04  G. Branden Robinson <g.branden.robinson@gmail.com>
+
        [tbl]: Regression-test Savannah #61417.
 
        * src/preproc/tbl/tests/\
diff --git a/src/preproc/tbl/table.cpp b/src/preproc/tbl/table.cpp
index 11950f1..06774b8 100644
--- a/src/preproc/tbl/table.cpp
+++ b/src/preproc/tbl/table.cpp
@@ -1534,7 +1534,12 @@ void table::add_entry(int r, int c, const string &str,
       e = new double_line_entry(this, f);
   }
   else if (str == "\\^") {
-    do_vspan(r, c);
+    if (r == 0) {
+      error("first row cannot contain a vertical span entry '\\^'");
+      e = new empty_entry(this, f);
+    }
+    else
+      do_vspan(r, c);
   }
   else if (str.length() > 2 && str[0] == '\\' && str[1] == 'R') {
     if (str.search('\n') >= 0)