From: Ingo Schwarze <schwarze@usta.de>
To: Kristaps Dzonsons <kristaps@bsd.lv>
Cc: tech@mdocml.bsd.lv
Subject: Re: Crash in mandoc HEAD
Date: Sun, 17 Aug 2014 06:16:00 +0200 [thread overview]
Message-ID: <20140817041600.GI12335@iris.usta.de> (raw)
In-Reply-To: <53EE10ED.5090400@bsd.lv>
Hi Kristaps,
Kristaps Dzonsons wrote on Fri, Aug 15, 2014 at 03:53:49PM +0200:
> I managed to crash mandoc(1) today while formatting a manual.
> Narrowed down:
>
> 1 .Dd $Mdocdate$
> 2 .Dt FOO 1
> 3 .Os
> 4 .Sh NAME
> 5 .Nm foo
> 6 .Nd bar
> 7 .Sh DESCRIPTION
> 8 The
> 9 .Bl -hang
> 10 .It Nm Fo o
> 11 xyzzy
> 12 .El
>
> In short, the "Fo" is continuing a node subtree perpetually and the
> HEAD for the "It" on line 10 just keeps going. There's a check for
> "n->next->child" which thus crashes because "n->next" is NULL.
>
> The fix is very simple and enclosed.
That's nearly right, but insufficient, the same pointer is
accessed a second time a few lines below, so it still crashes.
Please commit ASAP in the following form, I'll take care of the
merging.
Thanks,
Ingo
Index: mdoc_term.c
===================================================================
RCS file: /cvs/src/usr.bin/mandoc/mdoc_term.c,v
retrieving revision 1.177
diff -u -p -r1.177 mdoc_term.c
--- mdoc_term.c 8 Aug 2014 16:17:09 -0000 1.177
+++ mdoc_term.c 17 Aug 2014 04:08:09 -0000
@@ -804,7 +804,7 @@ termp_it_pre(DECL_ARGS)
* the "overstep" effect in term_flushln() and treat
* this as a `-ohang' list instead.
*/
- if (n->next->child &&
+ if (NULL != n->next && NULL != n->next->child &&
(MDOC_Bl == n->next->child->tok ||
MDOC_Bd == n->next->child->tok))
break;
@@ -860,7 +860,8 @@ termp_it_pre(DECL_ARGS)
* don't want to recalculate rmargin and offsets when
* using `Bd' or `Bl' within `-hang' overstep lists.
*/
- if (MDOC_HEAD == n->type && n->next->child &&
+ if (MDOC_HEAD == n->type &&
+ NULL != n->next && NULL != n->next->child &&
(MDOC_Bl == n->next->child->tok ||
MDOC_Bd == n->next->child->tok))
break;
--
To unsubscribe send an email to tech+unsubscribe@mdocml.bsd.lv
prev parent reply other threads:[~2014-08-17 4:16 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-08-15 13:53 Kristaps Dzonsons
2014-08-17 4:16 ` Ingo Schwarze [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140817041600.GI12335@iris.usta.de \
--to=schwarze@usta.de \
--cc=kristaps@bsd.lv \
--cc=tech@mdocml.bsd.lv \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).