From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from localhost (fantadrom.bsd.lv [local]) by fantadrom.bsd.lv (OpenSMTPD) with ESMTPA id 1d3f73f4 for ; Thu, 11 Aug 2016 08:30:55 -0500 (EST) Date: Thu, 11 Aug 2016 08:30:55 -0500 (EST) Message-Id: <16937554755328550823.enqueue@fantadrom.bsd.lv> X-Mailinglist: mdocml-source Reply-To: source@mdocml.bsd.lv MIME-Version: 1.0 From: schwarze@mdocml.bsd.lv To: source@mdocml.bsd.lv Subject: mdocml: Even after switching from a pending head to the body, we have to X-Mailer: activitymail 1.26, http://search.cpan.org/dist/activitymail/ Content-Type: text/plain; charset=utf-8 Log Message: ----------- Even after switching from a pending head to the body, we have to continue scanning upwards, because the enclosing block might already be pending as well, e.g. .Bl .Bl .It Bo .El .It. Tree corruption leading to a later NULL deref found by tb@ with afl(1). Modified Files: -------------- mdocml: mdoc_macro.c Revision Data ------------- Index: mdoc_macro.c =================================================================== RCS file: /home/cvs/mdocml/mdocml/mdoc_macro.c,v retrieving revision 1.206 retrieving revision 1.207 diff -Lmdoc_macro.c -Lmdoc_macro.c -u -p -r1.206 -r1.207 --- mdoc_macro.c +++ mdoc_macro.c @@ -292,7 +292,7 @@ rew_pending(struct roff_man *mdoc, const case ROFFT_HEAD: roff_body_alloc(mdoc, n->line, n->pos, n->tok); - return; + break; case ROFFT_BLOCK: break; default: -- To unsubscribe send an email to source+unsubscribe@mdocml.bsd.lv