From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from localhost (fantadrom.bsd.lv [local]);
	by fantadrom.bsd.lv (OpenSMTPD) with ESMTPA id b38f7bf0;
	for <source@mdocml.bsd.lv>;
	Wed, 24 Dec 2014 10:39:25 -0500 (EST)
Date: Wed, 24 Dec 2014 10:39:25 -0500 (EST)
Message-Id: <7627869573278475411.enqueue@fantadrom.bsd.lv>
X-Mailinglist: mdocml-source
Reply-To: source@mdocml.bsd.lv
MIME-Version: 1.0
From: schwarze@mdocml.bsd.lv
To: source@mdocml.bsd.lv
Subject: mdocml: Prevent unsigned integer underflow when a number is too wide for 
X-Mailer: activitymail 1.26, http://search.cpan.org/dist/activitymail/
Content-Type: text/plain; charset=utf-8

Log Message:
-----------
Prevent unsigned integer underflow when a number is too wide
for a table cell with an "nz" layout specification, 
causing essentially infinite output as found by jsg@ with afl.

Modified Files:
--------------
    mdocml:
        tbl_term.c

Revision Data
-------------
Index: tbl_term.c
===================================================================
RCS file: /home/cvs/mdocml/mdocml/tbl_term.c,v
retrieving revision 1.31
retrieving revision 1.32
diff -Ltbl_term.c -Ltbl_term.c -u -p -r1.31 -r1.32
--- tbl_term.c
+++ tbl_term.c
@@ -417,9 +417,13 @@ tbl_number(struct termp *tp, const struc
 	} else
 		d = sz + psz;
 
-	padl = col->decimal - d;
-
-	tbl_char(tp, ASCII_NBRSP, padl);
+	if (col->decimal > d && col->width > sz) {
+		padl = col->decimal - d;
+		if (padl + sz > col->width)
+			padl = col->width - sz;
+		tbl_char(tp, ASCII_NBRSP, padl);
+	} else
+		padl = 0;
 	tbl_word(tp, dp);
 	if (col->width > sz + padl)
 		tbl_char(tp, ASCII_NBRSP, col->width - sz - padl);
--
 To unsubscribe send an email to source+unsubscribe@mdocml.bsd.lv