mandoc: If .ti had an excessive argument, using it was attempted, in

mandoc: If .ti had an excessive argument, using it was attempted, in

[schwarze]

Log Message:
-----------
If .ti had an excessive argument, using it was attempted, in some
cases resulting in an assertion failure.  Instead, truncate the
temporary indent to a width reasonable in a manual page.

I found the issue in an afl run
that was performed by Jan Schreiber <jes at posteo dot de>.

Modified Files:
--------------
    mandoc:
        roff_term.c
    mandoc/regress/roff/ti:
        Makefile

Added Files:
-----------
    mandoc/regress/roff/ti:
        wide.in
        wide.out_ascii

Revision Data
-------------
Index: roff_term.c
===================================================================
RCS file: /home/cvs/mandoc/mandoc/roff_term.c,v
retrieving revision 1.20
retrieving revision 1.21
diff -Lroff_term.c -Lroff_term.c -u -p -r1.20 -r1.21
--- roff_term.c
+++ roff_term.c
@@ -210,6 +210,7 @@ roff_term_pre_ti(ROFF_TERM_ARGS)
 {
 	struct roffsu	 su;
 	const char	*cp;
+	const size_t	 maxoff = 72;
 	int		 len, sign;
 
 	roff_term_pre_br(p, n);
@@ -230,17 +231,26 @@ roff_term_pre_ti(ROFF_TERM_ARGS)
 		return;
 	len = term_hen(p, &su);
 
-	if (sign == 0) {
+	switch (sign) {
+	case 1:
+		if (p->tcol->offset + len <= maxoff)
+			p->ti = len;
+		else if (p->tcol->offset < maxoff)
+			p->ti = maxoff - p->tcol->offset;
+		else
+			p->ti = 0;
+		break;
+	case -1:
+		if ((size_t)len < p->tcol->offset)
+			p->ti = -len;
+		else
+			p->ti = -p->tcol->offset;
+		break;
+	default:
+		if ((size_t)len > maxoff)
+			len = maxoff;
 		p->ti = len - p->tcol->offset;
-		p->tcol->offset = len;
-	} else if (sign == 1) {
-		p->ti = len;
-		p->tcol->offset += len;
-	} else if ((size_t)len < p->tcol->offset) {
-		p->ti = -len;
-		p->tcol->offset -= len;
-	} else {
-		p->ti = -p->tcol->offset;
-		p->tcol->offset = 0;
+		break;
 	}
+	p->tcol->offset += p->ti;
 }
Index: Makefile
===================================================================
RCS file: /home/cvs/mandoc/mandoc/regress/roff/ti/Makefile,v
retrieving revision 1.1
retrieving revision 1.2
diff -Lregress/roff/ti/Makefile -Lregress/roff/ti/Makefile -u -p -r1.1 -r1.2
--- regress/roff/ti/Makefile
+++ regress/roff/ti/Makefile
@@ -1,5 +1,11 @@
-# $OpenBSD: Makefile,v 1.1 2017/05/07 17:30:58 schwarze Exp $
+# $OpenBSD: Makefile,v 1.2 2020/09/03 17:37:06 schwarze Exp $
 
-REGRESS_TARGETS	= basic-mdoc basic-man
+REGRESS_TARGETS	 = basic-mdoc basic-man wide
+
+# groff-1.22.4 defect:
+# - Excessive temporare indentations cause excessive line lengths
+#   instead of being truncated to resonable indentations.
+
+SKIP_GROFF	 = wide
 
 .include <bsd.regress.mk>
--- /dev/null
+++ regress/roff/ti/wide.out_ascii
@@ -0,0 +1,22 @@
+TI-WIDE(1)                  General Commands Manual                 TI-WIDE(1)
+
+
+
+N\bNA\bAM\bME\bE
+       ti-wide - excessive temporary indentation
+
+D\bDE\bES\bSC\bCR\bRI\bIP\bPT\bTI\bIO\bON\bN
+       Absolute .ti of more than 72n:
+                                                                        max
+                                               Indented block plus excessive
+                                               relative indentation:
+                                                                        max
+                                                                         Block
+                                                                         beyond
+                                                                         72n:
+                                                                         same
+       Back to normal.
+
+
+
+OpenBSD                        September 3, 2020                    TI-WIDE(1)
--- /dev/null
+++ regress/roff/ti/wide.in
@@ -0,0 +1,19 @@
+.\" $OpenBSD: wide.in,v 1.1 2020/09/03 17:37:06 schwarze Exp $
+.TH TI-WIDE 1 "September 3, 2020"
+.SH NAME
+ti-wide \- excessive temporary indentation
+.SH DESCRIPTION
+Absolute .ti of more than 72n:
+.ti 80n
+max
+.RS 40n
+Indented block plus excessive relative indentation:
+.ti +40n
+max
+.RE
+.RS 66n
+Block beyond 72n:
+.ti +4n
+same
+.RE
+Back to normal.
--
 To unsubscribe send an email to source+unsubscribe@mandoc.bsd.lv