Re: Bug: crash in mdoc_bl_pre() in mdoc_html.c:843

[Ingo Schwarze <schwarze@usta.de>]

Hi Michael,

Thanks for the excellent report.  I didn't even need to fire up the
debugger to understand what was going on and to fix it.

Yours,
  Ingo


Log Message:
-----------
.Bl -column with zero columns is legal, so don't segfalt on it.
Bug introduced in rev. 1.248 triggered for example in gssapi(3), 
analyzed and reported by Michael <Stapelberg at debian dot org>.
Simplify the code a bit more while here.

Modified Files:
--------------
    mdocml:
        mdoc_html.c

Revision Data
-------------
Index: mdoc_html.c
===================================================================
RCS file: /home/cvs/mdocml/mdocml/mdoc_html.c,v
retrieving revision 1.261
retrieving revision 1.262
diff -Lmdoc_html.c -Lmdoc_html.c -u -p -r1.261 -r1.262
--- mdoc_html.c
+++ mdoc_html.c
@@ -817,18 +817,21 @@ mdoc_it_pre(MDOC_ARGS)
 static int
 mdoc_bl_pre(MDOC_ARGS)
 {
+	struct mdoc_bl	*bl;
 	const char	*cattr;
-	int		 i;
+	size_t		 i;
 	enum htmltag	 elemtype;
 
+	bl = &n->norm->Bl;
+
 	if (n->type == ROFFT_BODY) {
-		if (LIST_column == n->norm->Bl.type)
+		if (bl->type == LIST_column)
 			print_otag(h, TAG_TBODY, "");
 		return 1;
 	}
 
 	if (n->type == ROFFT_HEAD) {
-		if (LIST_column != n->norm->Bl.type)
+		if (bl->type != LIST_column || bl->ncols == 0)
 			return 0;
 
 		/*
@@ -838,14 +841,13 @@ mdoc_bl_pre(MDOC_ARGS)
 		 * screen and we want to preserve that behaviour.
 		 */
 
-		for (i = 0; i < (int)n->norm->Bl.ncols - 1; i++)
-			print_otag(h, TAG_COL, "sww", n->norm->Bl.cols[i]);
-		print_otag(h, TAG_COL, "swW", n->norm->Bl.cols[i]);
-
+		for (i = 0; i < bl->ncols - 1; i++)
+			print_otag(h, TAG_COL, "sww", bl->cols[i]);
+		print_otag(h, TAG_COL, "swW", bl->cols[i]);
 		return 0;
 	}
 
-	switch (n->norm->Bl.type) {
+	switch (bl->type) {
 	case LIST_bullet:
 		elemtype = TAG_UL;
 		cattr = "Bl-bullet";
@@ -881,14 +883,12 @@ mdoc_bl_pre(MDOC_ARGS)
 		break;
 	case LIST_tag:
 		cattr = "Bl-tag";
-		if (n->norm->Bl.offs)
-			print_otag(h, TAG_DIV, "cswl", cattr,
-			    n->norm->Bl.offs);
-		if (n->norm->Bl.width == NULL)
+		if (bl->offs)
+			print_otag(h, TAG_DIV, "cswl", cattr, bl->offs);
+		if (bl->width == NULL)
 			print_otag(h, TAG_DL, "c", cattr);
 		else
-			print_otag(h, TAG_DL, "cswl", cattr,
-			    n->norm->Bl.width);
+			print_otag(h, TAG_DL, "cswl", cattr, bl->width);
 		return 1;
 	case LIST_column:
 		elemtype = TAG_TABLE;
@@ -898,8 +898,8 @@ mdoc_bl_pre(MDOC_ARGS)
 		abort();
 	}
 
-	if (n->norm->Bl.offs)
-		print_otag(h, elemtype, "cswl", cattr, n->norm->Bl.offs);
+	if (bl->offs)
+		print_otag(h, elemtype, "cswl", cattr, bl->offs);
 	else
 		print_otag(h, elemtype, "c", cattr);
 
--
 To unsubscribe send an email to tech+unsubscribe@mdocml.bsd.lv