Repository navigation
texttotext: restore the default tab width instead of just logging it - #283
Merged
tillkamppeter merged 1 commit intoOct 12, 2026
Conversation
cfFilterTextToText() parsed TabWidth/tab-width straight into tab_width via atoi(), then only used the validity check (tab_width <= 0 || tab_width > num_columns - 1) to pick which debug message to log -- neither branch ever reset tab_width itself. The debug message claims 'use default' but nothing did; an explicit TabWidth=0 (or any non-positive value) left tab_width at 0 all the way to the character loop, where 'column % tab_width' is evaluated for every tab character in the document and divides by zero. Reset tab_width to the documented default (8, the same value the variable is initialized to) when the validity check fails, instead of only logging that it would be. Also fixes the less severe half of the same check (tab_width > num_columns - 1 was flagged invalid but likewise never clamped). Verified by extracting the atoi-and-validate logic and the vulnerable modulo into a standalone reproduction: TabWidth=0 through the unfixed validation crashes before anything is printed (the division by zero); through the fixed validation, tab_width is restored to 8 and the modulo completes normally. Fixes OpenPrinting#180.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #180
cfFilterTextToText()parsedTabWidth/tab-widthstraight intotab_widthviaatoi(), then only used the validity check (tab_width <= 0 || tab_width > num_columns - 1) to pick which debug message to log — neither branch ever resettab_widthitself. The debug message claims "use default" but nothing did; an explicitTabWidth=0(or any non-positive value) lefttab_widthat 0 all the way to the character loop, wherecolumn % tab_widthis evaluated for every tab character in the document and divides by zero.Reset
tab_widthto the documented default (8, the same value the variable is initialized to) when the validity check fails, instead of only logging that it would be. Also fixes the less severe half of the same check (tab_width > num_columns - 1was flagged invalid but likewise never clamped).Verification: extracted the
atoi-and-validate logic and the vulnerable modulo into a standalone reproduction:TabWidth=0through the unfixed validation crashes before anything is printed (the division by zero); through the fixed validation,tab_widthis restored to 8 and the modulo completes normally.