From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from localhost (fantadrom.bsd.lv [local]);
	by fantadrom.bsd.lv (OpenSMTPD) with ESMTPA id 2e7235f2;
	for <source@mdocml.bsd.lv>;
	Sat, 7 Feb 2015 11:43:04 -0500 (EST)
Date: Sat, 7 Feb 2015 11:43:04 -0500 (EST)
Message-Id: <13297940742494743691.enqueue@fantadrom.bsd.lv>
X-Mailinglist: mdocml-source
Reply-To: source@mdocml.bsd.lv
MIME-Version: 1.0
From: schwarze@mdocml.bsd.lv
To: source@mdocml.bsd.lv
Subject: mdocml: Closing a block validates it, which may end up deleting it, so 
X-Mailer: activitymail 1.26, http://search.cpan.org/dist/activitymail/
Content-Type: text/plain; charset=utf-8

Log Message:
-----------
Closing a block validates it, which may end up deleting it,
so if we are in a loop over blocks, cleanly restart the loop
rather than risking use after free; found by jsg@ with afl.

Modified Files:
--------------
    mdocml:
        mdoc_macro.c

Revision Data
-------------
Index: mdoc_macro.c
===================================================================
RCS file: /home/cvs/mdocml/mdocml/mdoc_macro.c,v
retrieving revision 1.179
retrieving revision 1.180
diff -Lmdoc_macro.c -Lmdoc_macro.c -u -p -r1.179 -r1.180
--- mdoc_macro.c
+++ mdoc_macro.c
@@ -941,6 +941,7 @@ blk_full(MACRO_PROT_ARGS)
 					    mdoc_macronames[tok],
 					    mdoc_macronames[n->tok]);
 					rew_pending(mdoc, n);
+					n = mdoc->last;
 					continue;
 				case MDOC_It:
 					/* Delay in case it's astray. */
--
 To unsubscribe send an email to source+unsubscribe@mdocml.bsd.lv