From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from krisdoz.my.domain (schwarze@localhost [127.0.0.1])
	by krisdoz.my.domain (8.14.5/8.14.5) with ESMTP id sAKDuLUt012208
	for <source@mdocml.bsd.lv>; Thu, 20 Nov 2014 08:56:21 -0500 (EST)
Received: (from schwarze@localhost)
	by krisdoz.my.domain (8.14.5/8.14.3/Submit) id sAKDuKLX018319;
	Thu, 20 Nov 2014 08:56:20 -0500 (EST)
Date: Thu, 20 Nov 2014 08:56:20 -0500 (EST)
Message-Id: <201411201356.sAKDuKLX018319@krisdoz.my.domain>
X-Mailinglist: mdocml-source
Reply-To: source@mdocml.bsd.lv
MIME-Version: 1.0
From: schwarze@mdocml.bsd.lv
To: source@mdocml.bsd.lv
Subject: mdocml: Prevent negative arguments to the .ll request from causing 
X-Mailer: activitymail 1.26, http://search.cpan.org/dist/activitymail/
Content-Type: text/plain; charset=utf-8

Log Message:
-----------
Prevent negative arguments to the .ll request from causing integer
underflow.  Found while preparing an audit of termp.rmargin.

Overflow can also happen, but i see no sane way to deal with it,
so just let it happen.  It doesn't happen for any sane input anyway,
groff behaviour is undefined, and the resulting values are legal, 
even though they are useless.

Modified Files:
--------------
    mdocml:
        term_ascii.c
        term_ps.c

Revision Data
-------------
Index: term_ascii.c
===================================================================
RCS file: /usr/vhosts/mdocml.bsd.lv/cvs/mdocml/term_ascii.c,v
retrieving revision 1.39
retrieving revision 1.40
diff -Lterm_ascii.c -Lterm_ascii.c -u -p -r1.39 -r1.40
--- term_ascii.c
+++ term_ascii.c
@@ -159,12 +159,14 @@ ascii_setwidth(struct termp *p, int iop,
 {
 
 	p->rmargin = p->defrmargin;
-	if (0 < iop)
+	if (iop > 0)
 		p->defrmargin += width;
-	else if (0 > iop)
+	else if (iop == 0)
+		p->defrmargin = width ? width : p->lastrmargin;
+	else if (p->defrmargin > width)
 		p->defrmargin -= width;
 	else
-		p->defrmargin = width ? width : p->lastrmargin;
+		p->defrmargin = 0;
 	p->lastrmargin = p->rmargin;
 	p->rmargin = p->maxrmargin = p->defrmargin;
 }
Index: term_ps.c
===================================================================
RCS file: /usr/vhosts/mdocml.bsd.lv/cvs/mdocml/term_ps.c,v
retrieving revision 1.68
retrieving revision 1.69
diff -Lterm_ps.c -Lterm_ps.c -u -p -r1.68 -r1.69
--- term_ps.c
+++ term_ps.c
@@ -635,12 +635,14 @@ ps_setwidth(struct termp *p, int iop, si
 	size_t	 lastwidth;
 
 	lastwidth = p->ps->width;
-	if (0 < iop)
+	if (iop > 0)
 		p->ps->width += width;
-	else if (0 > iop)
+	else if (iop == 0)
+		p->ps->width = width ? width : p->ps->lastwidth;
+	else if (p->ps->width > width)
 		p->ps->width -= width;
 	else
-		p->ps->width = width ? width : p->ps->lastwidth;
+		p->ps->width = 0;
 	p->ps->lastwidth = lastwidth;
 }
 
--
 To unsubscribe send an email to source+unsubscribe@mdocml.bsd.lv