From 0ff48e5d3d633bb36a7daf000dac2f631a434769 Mon Sep 17 00:00:00 2001
From: Vijay Misal <misalvijay153@gmail.com>
Date: Mon, 10 Aug 2026 21:33:35 +0530
Subject: [PATCH] Fix reference link title incorrectly kept when followed by
 garbage

cmark_parse_reference_inline() speculatively parses a link title after
a reference definition's URL. If what follows the title is not the end
of the line (i.e. there is trailing garbage), the function rewinds and
retries treating the URL's line as ending right after the URL, so that
the "title" text is left as ordinary paragraph content instead of
being consumed as part of the reference definition.

However, on this rewind path the previously scanned `title` chunk was
never reset, so the reference was still registered with that title
even though it was determined to be invalid. This let garbage-suffixed
"titles" leak into the parsed link, e.g.:

    [bla]: /bla
    "The title" garbage
    [bla]

incorrectly produced `<a href="/bla" title="The title">`, even though
the CommonMark reference dingus (and any spec-conformant parser)
produces no title here, since `"The title" garbage` is not a valid
title specification.

Fix: reset `title` to an empty chunk on the rewind path, matching the
behavior of the "no title matched" branch just below it.

Added a regression test (Issue #468) to test/regression.txt covering
this exact case.

Fixes commonmark/cmark#468
---
 src/inlines.c       |  4 ++++
 test/regression.txt | 10 ++++++++++
 2 files changed, 14 insertions(+)

diff --git a/src/inlines.c b/src/inlines.c
index 9143bbb5f..bf765eab5 100644
--- a/src/inlines.c
+++ b/src/inlines.c
@@ -1495,6 +1495,10 @@ bufsize_t cmark_parse_reference_inline(cmark_mem *mem, cmark_chunk *input,
       if (!skip_line_end(&subj)) {
         return 0;
       }
+      // the previously scanned title turned out to be invalid (it was
+      // followed by trailing garbage instead of the end of the line), so
+      // the reference has no title after all.
+      title = cmark_chunk_literal("");
     } else {
       return 0;
     }
diff --git a/test/regression.txt b/test/regression.txt
index 4140ba2d1..2eb818444 100644
--- a/test/regression.txt
+++ b/test/regression.txt
@@ -321,3 +321,13 @@ Issue #611:
 <p><foo>text</foo></p>
 ````````````````````````````````
 
+Issue #468: Link reference definition title followed by trailing
+garbage on the same line must not be treated as a title.
+```````````````````````````````` example
+[bla]: /bla
+"The title" garbage
+[bla]
+.
+<p>&quot;The title&quot; garbage
+<a href="/bla">bla</a></p>
+````````````````````````````````