mdocml: Improve detection of recursive eqn(7) "define" statements: Do

mdocml: Improve detection of recursive eqn(7) "define" statements: Do

[schwarze]

Log Message:
-----------
Improve detection of recursive eqn(7) "define" statements:
Do not only catch "define key 'key other stuff'",
but also "define key 'other stuff key'".
Fixing infinite loop found by tb@ with afl(1).

Modified Files:
--------------
    mdocml:
        eqn.c

Revision Data
-------------
Index: eqn.c
===================================================================
RCS file: /home/cvs/mdocml/mdocml/eqn.c,v
retrieving revision 1.61
retrieving revision 1.62
diff -Leqn.c -Leqn.c -u -p -r1.61 -r1.62
--- eqn.c
+++ eqn.c
@@ -366,15 +366,19 @@ eqn_def_find(struct eqn_node *ep, const 
 static const char *
 eqn_next(struct eqn_node *ep, char quote, size_t *sz, int repl)
 {
+	static size_t	 last_len;
+	static int	 lim;
+
 	char		*start, *next;
-	int		 q, diff, lim;
+	int		 q, diff;
 	size_t		 ssz, dummy;
 	struct eqn_def	*def;
 
 	if (NULL == sz)
 		sz = &dummy;
 
-	lim = 0;
+	if (ep->cur >= last_len)
+		lim = 0;
 	ep->rew = ep->cur;
 again:
 	/* Prevent self-definitions. */
@@ -448,6 +452,7 @@ again:
 		memmove(start + *sz + diff, start + *sz,
 		    (strlen(start) - *sz) + 1);
 		memcpy(start, def->val, def->valsz);
+		last_len = start - ep->data + def->valsz;
 		lim++;
 		goto again;
 	}
--
 To unsubscribe send an email to source+unsubscribe@mdocml.bsd.lv