[tex-k] Bug in web2c or MF: segfault using scantokens in recursive macro

[Dominik Leininger]

Hi everyone,

I came across a segmentation fault when passing the following input to 
METAFONT:
	def?=scantokens""?enddef;?
where other tokens can be used instead of ? and the string token can 
contain tokens/commands/etc.

I tested this on Ubuntu 22.04 (METAFONT, Version 2.71828182 (TeX Live 
2022/dev/Debian)) and Windows 10 (METAFONT, Version 2.71828182 (TeX Live 
2023)). On Ubuntu, mf exits with "Segmentation fault (core dumped)", 
exit code 139. On Windows, mf simply exits with no output or error 
message, %errorlevel% is -1073741571.

I don't know if this is a bug in web2c or in MF. Can someone try to 
reproduce this behavior with original METAFONT?

Since scantokens causes ? to be expanded before any tokens in the 
(empty) string, I would expect a "! METAFONT capacity exceeded, sorry." 
error, mentioning the "number of strings" or "input stack size" or a 
different part of MF's memory.

Best regards,
Dominik