From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mailout.scc.kit.edu (mailout.scc.kit.edu [129.13.185.202])
	by krisdoz.my.domain (8.14.5/8.14.5) with ESMTP id s9EIOvL9006246
	for <discuss@mdocml.bsd.lv>; Tue, 14 Oct 2014 14:24:57 -0400 (EDT)
Received: from hekate.usta.de (asta-nat.asta.uni-karlsruhe.de [172.22.63.82])
	by scc-mailout-02.scc.kit.edu with esmtp (Exim 4.72 #1)
	id 1Xe6mG-00084Z-I7; Tue, 14 Oct 2014 20:24:56 +0200
Received: from donnerwolke.usta.de ([172.24.96.3])
	by hekate.usta.de with esmtp (Exim 4.77)
	(envelope-from <schwarze@usta.de>)
	id 1Xe6mG-0003mT-Fw; Tue, 14 Oct 2014 20:24:56 +0200
Received: from iris.usta.de ([172.24.96.5] helo=usta.de)
	by donnerwolke.usta.de with esmtp (Exim 4.72)
	(envelope-from <schwarze@usta.de>)
	id 1Xe6mG-0001Ps-EO; Tue, 14 Oct 2014 20:24:56 +0200
Received: from schwarze by usta.de with local (Exim 4.77)
	(envelope-from <schwarze@usta.de>)
	id 1Xe6lW-0008U1-RF; Tue, 14 Oct 2014 20:24:10 +0200
Date: Tue, 14 Oct 2014 20:24:10 +0200
From: Ingo Schwarze <schwarze@usta.de>
To: "Anthony J. Bentley" <anthony@cathet.us>
Cc: discuss@mdocml.bsd.lv
Subject: Re: Crash when run against groff tbl(1) output
Message-ID: <20141014182410.GJ28294@iris.usta.de>
References: <15458.1413266839@cathet.us>
X-Mailinglist: mdocml-discuss
Reply-To: discuss@mdocml.bsd.lv
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <15458.1413266839@cathet.us>
User-Agent: Mutt/1.5.21 (2010-09-15)

Hi Anthony,

Anthony J. Bentley wrote on Tue, Oct 14, 2014 at 12:07:19AM -0600:

> Here is a reduced (possibly nonsensical) form of that input that
> triggers what I hope is the same crash; backtrace follows.
> 
> .TS
> .if !'\n(.z'' \!.foo
> .de bar
> ..
> \!.baz
> .baz x

Here is a minimal example:

  .TS
  |.
  \&

That makes it quite obvious what the problem is, doesn't it?  ;-)

Committed fix below.

Thanks for reporting,
  Ingo


Log Message:
-----------
even if a table has zero columns, do not segfault in the formatter;
bug reported by bentley@

Modified Files:
--------------
    mdocml:
        out.c
        tbl_term.c

Revision Data
-------------
Index: out.c
===================================================================
RCS file: /usr/vhosts/mdocml.bsd.lv/cvs/mdocml/out.c,v
retrieving revision 1.52
retrieving revision 1.53
diff -Lout.c -Lout.c -u -p -r1.52 -r1.53
--- out.c
+++ out.c
@@ -158,7 +158,7 @@ tblcalc(struct rofftbl *tbl, const struc
 	tbl->cols = mandoc_calloc((size_t)sp->opts->cols,
 	    sizeof(struct roffcol));
 
-	for (maxcol = 0; sp; sp = sp->next) {
+	for (maxcol = -1; sp; sp = sp->next) {
 		if (TBL_SPAN_DATA != sp->pos)
 			continue;
 		spans = 1;
Index: tbl_term.c
===================================================================
RCS file: /usr/vhosts/mdocml.bsd.lv/cvs/mdocml/tbl_term.c,v
retrieving revision 1.30
retrieving revision 1.31
diff -Ltbl_term.c -Ltbl_term.c -u -p -r1.30 -r1.31
--- tbl_term.c
+++ tbl_term.c
@@ -107,7 +107,7 @@ term_tbl(struct termp *tp, const struct 
 	/* Vertical frame at the start of each row. */
 
 	if ((TBL_OPT_BOX | TBL_OPT_DBOX) & sp->opts->opts ||
-	    sp->head->vert)
+	    (sp->head != NULL && sp->head->vert))
 		term_word(tp, TBL_SPAN_HORIZ == sp->pos ||
 		    TBL_SPAN_DHORIZ == sp->pos ? "+" : "|");
 
--
 To unsubscribe send an email to discuss+unsubscribe@mdocml.bsd.lv