diff options
| author |   schwarze <schwarze@openbsd.org> | 2017-02-10 22:19:11 +0000 |
|---|---|---|
| committer | schwarze <schwarze@openbsd.org> | 2017-02-10 22:19:11 +0000 |
| commit | c25da3619eb257aedfe325f9bfada821464e6ce2 (patch) | |
| tree | adaca27584a83bd765060781fdaff45def44c145 /usr.bin/mandoc/mdoc_macro.c | |
| parent | Oops, the previous commit unintentionally included this file. (diff) | |
| download | wireguard-openbsd-c25da3619eb257aedfe325f9bfada821464e6ce2.tar.xz wireguard-openbsd-c25da3619eb257aedfe325f9bfada821464e6ce2.zip | |
For child macros of block-end macros, only scan backwards for pending
breakers unless the parent of the block is already closed. While
the scanning is needed in cases like ".Ac Bo" for broken Ao, it is
useless and crashy in cases like ".Ac Bc" for non-broken Ao.
This fixes a NULL pointer dereference that tb@ found with afl(1).
Diffstat (limited to 'usr.bin/mandoc/mdoc_macro.c')
| -rw-r--r-- | usr.bin/mandoc/mdoc_macro.c | 15 |
1 files changed, 8 insertions, 7 deletions
diff --git a/usr.bin/mandoc/mdoc_macro.c b/usr.bin/mandoc/mdoc_macro.c index f26610be0aa..ffb50b32cc5 100644 --- a/usr.bin/mandoc/mdoc_macro.c +++ b/usr.bin/mandoc/mdoc_macro.c @@ -1,4 +1,4 @@ -/* $OpenBSD: mdoc_macro.c,v 1.168 2017/02/10 16:20:58 schwarze Exp $ */ +/* $OpenBSD: mdoc_macro.c,v 1.169 2017/02/10 22:19:11 schwarze Exp $ */ /* * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps@bsd.lv> * Copyright (c) 2010, 2012-2016 Ingo Schwarze <schwarze@openbsd.org> @@ -396,9 +396,9 @@ find_pending(struct roff_man *mdoc, int tok, int line, int ppos, if (n->type == ROFFT_BLOCK && mdoc_macros[n->tok].flags & MDOC_EXPLICIT) { irc = 1; - n->flags = NODE_BROKEN; + n->flags |= NODE_BROKEN; if (target->type == ROFFT_HEAD) - target->flags = NODE_ENDED; + target->flags |= NODE_ENDED; else if ( ! (target->flags & NODE_ENDED)) { mandoc_vmsg(MANDOCERR_BLK_NEST, mdoc->parse, line, ppos, @@ -712,15 +712,16 @@ blk_exp_close(MACRO_PROT_ARGS) } if (n != NULL) { + pending = 0; if (ntok != TOKEN_NONE && n->flags & NODE_BROKEN) { target = n; do target = target->parent; while ( ! (target->flags & NODE_ENDED)); - pending = find_pending(mdoc, ntok, line, ppos, - target); - } else - pending = 0; + if ( ! (target->flags & NODE_VALID)) + pending = find_pending(mdoc, ntok, + line, ppos, target); + } if ( ! pending) rew_pending(mdoc, n); } |