Buffer overflow.

[ascherer]

See https://tug.org/pipermail/tex-live/2023-July/049306.html for details. This affects CWEB and WEB alike.

[ascherer]

Let's begin with a minimal working example out_buf-overflow.w that shows the differentiated behaviour:

% Overfull input lines in limbo:

% Plain TeX paragraph comment
% bbbbbb10 bbbbbbb20 bbbbbbb30 bbbbbbb40 bbbbbbb50 bbbbbbb60 bbbbbbb70 bbbbbbb80 bbbbbbb90 bbbbbb100 bbbbbb110 bbbbbb120 bbbbbb130 bbbbbb140 bbbbbb150 bbbbbb160

% Plain TeX block comment
%bbbbbbb10bbbbbbbb20bbbbbbbb30bbbbbbbb40bbbbbbbb50bbbbbbbb60bbbbbbbb70bbbbbbbb80bbbbbbbb90bbbbbbb100bbbbbbb110bbbbbbb120bbbbbbb130bbbbbbb140bbbbbbb150bbbbbbb160

% Escaped TeX macro block comment
%\bbbbbb10\bbbbbbb20\bbbbbbb30\bbbbbbb40\bbbbbbb50\bbbbbbb60\bbbbbbb70\bbbbbbb80\bbbbbbb90\bbbbbb100\bbbbbb110\bbbbbb120\bbbbbb130\bbbbbb140\bbbbbb150\bbbbbb160

% Escaped TeX block comment
%\bbbbbb10bbbbbbbb20bbbbbbbb30bbbbbbbb40bbbbbbbb50bbbbbbbb60bbbbbbbb70bbbbbbbb80bbbbbbbb90bbbbbbb100bbbbbbb110bbbbbbb120bbbbbbb130bbbbbbb140bbbbbbb150bbbbbbb160

Run this through

• classic WEAVE: Incomplete output for input 1 to 3 (cut at 100 chars; you have been warned), clobbered output for input 4
• TeX Live weave: Correct output for input 1 to 3, clobbered output for input 4
• classic CWEAVE: Correct output for input 1 to 3, zsh trace trap on input 4
• TeX Live cweave: Correct output for input 1 to 3, zsh trace trap on input 4

[ascherer]

Then let's check

• Long lines in TeX parts
• Extremely_long_identifiers_from_malicious_hackers
• Long "strings" (TANGLE and ctangle)
• Long lines introduced via change file

[ascherer]

Fix is imminent:

diff --git a/weave.web b/weave.web
index 4981570..f808fa5 100644
--- a/weave.web
+++ b/weave.web
@@ -2245,7 +2245,8 @@ loop@+  begin if k=0 then
   if d=" " then
     begin flush_buffer(k,false,true); return;
     end;
-  if (d="\")and(out_buf[k-1]<>"\") then {in this case |k>1|}
+  if (d="\")and(out_buf[k-1]<>"\")and(out_buf[k-1]<>"%") then
+      {in this case |k>1|}
     begin flush_buffer(k-1,true,true); return;
     end;
   decr(k);

diff --git a/cweave.w b/cweave.w
index 61fdc0a..06dc87c 100644
--- a/cweave.w
+++ b/cweave.w
@@ -1456,7 +1456,7 @@ break_out(void) /* finds a way to break the output line */
     if (*k==' ') {
       flush_buffer(k,false,true); return;
     }
-    if (*(k--)=='\\' && *k!='\\') { /* we've decreased |k| */
+    if (*(k--)=='\\' && *k!='\\' && *k!='%') { /* we've decreased |k| */
       flush_buffer(k,true,true); return;
     }
   }

[ascherer]

Extend the example input lines so that they are longer than buf_size (200). Then cweave reacts differently than weave. Check that input_ln (common.w) doesn't store more than buf_size characters.