mdocml: Reduce memory and time consumption on certain malformed input

[schwarze@mdocml.bsd.lv]

Log Message:
-----------
Reduce memory and time consumption on certain malformed input files
by limiting the length of expanded input lines during the
(usually recursive) expansion of user defined strings.
Resource hogging found by jsg@ with afl.

Modified Files:
--------------
    mdocml:
        roff.7
        roff.c

Revision Data
-------------
Index: roff.c
===================================================================
RCS file: /home/cvs/mdocml/mdocml/roff.c,v
retrieving revision 1.244
retrieving revision 1.245
diff -Lroff.c -Lroff.c -u -p -r1.244 -r1.245
--- roff.c
+++ roff.c
@@ -21,6 +21,7 @@
 
 #include <assert.h>
 #include <ctype.h>
+#include <limits.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -657,6 +658,12 @@ roff_res(struct roff *r, struct buf *buf
 		*stesc = '\0';
 		buf->sz = mandoc_asprintf(&nbuf, "%s%s%s",
 		    buf->buf, res, cp) + 1;
+
+		if (buf->sz > SHRT_MAX) {
+			mandoc_msg(MANDOCERR_ROFFLOOP, r->parse,
+			    ln, (int)(stesc - buf->buf), NULL);
+			return(ROFF_IGN);
+		}
 
 		/* Prepare for the next replacement. */
 
Index: roff.7
===================================================================
RCS file: /home/cvs/mdocml/mdocml/roff.7,v
retrieving revision 1.60
retrieving revision 1.61
diff -Lroff.7 -Lroff.7 -u -p -r1.60 -r1.61
--- roff.7
+++ roff.7
@@ -543,8 +543,10 @@ one explicit newline character.
 In order to prevent endless recursion, both groff and
 .Xr mandoc 1
 limit the stack depth for expanding macros and strings
-to a large, but finite number.
-Do not rely on the exact value of this limit.
+to a large, but finite number, and
+.Xr mandoc 1
+also limits the length of the expanded input line.
+Do not rely on the exact values of these limits.
 .Ss \&dei
 Define a
 .Nm
--
 To unsubscribe send an email to source+unsubscribe@mdocml.bsd.lv