From: schwarze@mdocml.bsd.lv
To: source@mdocml.bsd.lv
Subject: mdocml: Be more careful about meta->name.
Date: Fri, 28 Nov 2014 11:02:52 -0500 (EST) [thread overview]
Message-ID: <3156987663673481671.enqueue@fantadrom.bsd.lv> (raw)
Log Message:
-----------
Be more careful about meta->name. For weird input, it can be NULL.
Fixing a NULL access jsg@ found with afl.
Modified Files:
--------------
mdocml:
mdoc_term.c
Revision Data
-------------
Index: mdoc_term.c
===================================================================
RCS file: /home/cvs/mdocml/mdocml/mdoc_term.c,v
retrieving revision 1.295
retrieving revision 1.296
diff -Lmdoc_term.c -Lmdoc_term.c -u -p -r1.295 -r1.296
--- mdoc_term.c
+++ mdoc_term.c
@@ -995,6 +995,7 @@ termp_it_post(DECL_ARGS)
static int
termp_nm_pre(DECL_ARGS)
{
+ const char *cp;
if (MDOC_BLOCK == n->type) {
p->flags |= TERMP_PREKEEP;
@@ -1005,12 +1006,15 @@ termp_nm_pre(DECL_ARGS)
if (NULL == n->child)
return(0);
p->flags |= TERMP_NOSPACE;
- p->offset += term_len(p, 1) +
- (NULL == n->prev->child ?
- term_strlen(p, meta->name) :
- MDOC_TEXT == n->prev->child->type ?
- term_strlen(p, n->prev->child->string) :
- term_len(p, 5));
+ cp = NULL;
+ if (n->prev->child != NULL)
+ cp = n->prev->child->string;
+ if (cp == NULL)
+ cp = meta->name;
+ if (cp == NULL)
+ p->offset += term_len(p, 6);
+ else
+ p->offset += term_len(p, 1) + term_strlen(p, cp);
return(1);
}
--
To unsubscribe send an email to source+unsubscribe@mdocml.bsd.lv
reply other threads:[~2014-11-28 16:02 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3156987663673481671.enqueue@fantadrom.bsd.lv \
--to=schwarze@mdocml.bsd.lv \
--cc=source@mdocml.bsd.lv \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).