* Bug: crash in mdoc_bl_pre() in mdoc_html.c:843
@ 2017-01-28 12:57 Michael Stapelberg
2017-01-28 18:55 ` Ingo Schwarze
0 siblings, 1 reply; 2+ messages in thread
From: Michael Stapelberg @ 2017-01-28 12:57 UTC (permalink / raw)
To: tech
I think http://mdocml.bsd.lv/cgi-bin/cvsweb/mdoc_html.c.diff?r1=1.247&r2=1.248
introduced a bug, specifically this hunk:
@@ -856,62 +770,47 @@
* screen and we want to preserve that behaviour.
*/
- for (i = 0; i < (int)n->norm->Bl.ncols; i++) {
- bufinit(h);
- a2width(n->norm->Bl.cols[i], &su);
- if (i < (int)n->norm->Bl.ncols - 1)
- bufcat_su(h, "width", &su);
- else
- bufcat_su(h, "min-width", &su);
- PAIR_STYLE_INIT(&tag[0], h);
- print_otag(h, TAG_COL, 1, tag);
- }
+ for (i = 0; i < (int)n->norm->Bl.ncols - 1; i++)
+ print_otag(h, TAG_COL, "sww", n->norm->Bl.cols[i]);
+ print_otag(h, TAG_COL, "swW", n->norm->Bl.cols[i]);
[…]
To reproduce the crash, use:
$ curl https://manpages.debian.org/unstable/heimdal-dev/gssapi.3.en.gz
| ./mandoc -Thtml
[…]
segmentation fault (core dumped) ./mandoc -Thtml
$ gdb mandoc core
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x0000560b3ac5d977 in mdoc_bl_pre (meta=0x560b3c509130,
n=0x560b3c51dd50, h=0x560b3c509260) at mdoc_html.c:843
843 print_otag(h, TAG_COL, "swW", n->norm->Bl.cols[i]);
gdb $ bt
#0 0x0000560b3ac5d977 in mdoc_bl_pre (meta=0x560b3c509130,
n=0x560b3c51dd50, h=0x560b3c509260) at mdoc_html.c:843
#1 0x0000560b3ac5c6d4 in print_mdoc_node (meta=0x560b3c509130,
n=0x560b3c51dd50, h=0x560b3c509260) at mdoc_html.c:396
#2 0x0000560b3ac5c47f in print_mdoc_nodelist (meta=0x560b3c509130,
n=0x560b3c51dd50, h=0x560b3c509260) at mdoc_html.c:337
#3 0x0000560b3ac5c743 in print_mdoc_node (meta=0x560b3c509130,
n=0x560b3c51dcb0, h=0x560b3c509260) at mdoc_html.c:406
#4 0x0000560b3ac5c47f in print_mdoc_nodelist (meta=0x560b3c509130,
n=0x560b3c51dcb0, h=0x560b3c509260) at mdoc_html.c:337
#5 0x0000560b3ac5c743 in print_mdoc_node (meta=0x560b3c509130,
n=0x560b3c51d610, h=0x560b3c509260) at mdoc_html.c:406
#6 0x0000560b3ac5c47f in print_mdoc_nodelist (meta=0x560b3c509130,
n=0x560b3c51d610, h=0x560b3c509260) at mdoc_html.c:337
#7 0x0000560b3ac5c743 in print_mdoc_node (meta=0x560b3c509130,
n=0x560b3c51d380, h=0x560b3c509260) at mdoc_html.c:406
#8 0x0000560b3ac5c47f in print_mdoc_nodelist (meta=0x560b3c509130,
n=0x560b3c51d380, h=0x560b3c509260) at mdoc_html.c:337
#9 0x0000560b3ac5c2dd in html_mdoc (arg=0x560b3c509260,
mdoc=0x560b3c509130) at mdoc_html.c:304
#10 0x0000560b3ac7b011 in parse (curp=0x7fff20668810, fd=0,
file=0x560b3ac9db71 "<stdin>") at main.c:748
#11 0x0000560b3ac7a446 in main (argc=0, argv=0x7fff20668a18) at main.c:454
--
Best regards,
Michael
--
To unsubscribe send an email to tech+unsubscribe@mdocml.bsd.lv
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Bug: crash in mdoc_bl_pre() in mdoc_html.c:843
2017-01-28 12:57 Bug: crash in mdoc_bl_pre() in mdoc_html.c:843 Michael Stapelberg
@ 2017-01-28 18:55 ` Ingo Schwarze
0 siblings, 0 replies; 2+ messages in thread
From: Ingo Schwarze @ 2017-01-28 18:55 UTC (permalink / raw)
To: Michael Stapelberg; +Cc: tech
Hi Michael,
Thanks for the excellent report. I didn't even need to fire up the
debugger to understand what was going on and to fix it.
Yours,
Ingo
Log Message:
-----------
.Bl -column with zero columns is legal, so don't segfalt on it.
Bug introduced in rev. 1.248 triggered for example in gssapi(3),
analyzed and reported by Michael <Stapelberg at debian dot org>.
Simplify the code a bit more while here.
Modified Files:
--------------
mdocml:
mdoc_html.c
Revision Data
-------------
Index: mdoc_html.c
===================================================================
RCS file: /home/cvs/mdocml/mdocml/mdoc_html.c,v
retrieving revision 1.261
retrieving revision 1.262
diff -Lmdoc_html.c -Lmdoc_html.c -u -p -r1.261 -r1.262
--- mdoc_html.c
+++ mdoc_html.c
@@ -817,18 +817,21 @@ mdoc_it_pre(MDOC_ARGS)
static int
mdoc_bl_pre(MDOC_ARGS)
{
+ struct mdoc_bl *bl;
const char *cattr;
- int i;
+ size_t i;
enum htmltag elemtype;
+ bl = &n->norm->Bl;
+
if (n->type == ROFFT_BODY) {
- if (LIST_column == n->norm->Bl.type)
+ if (bl->type == LIST_column)
print_otag(h, TAG_TBODY, "");
return 1;
}
if (n->type == ROFFT_HEAD) {
- if (LIST_column != n->norm->Bl.type)
+ if (bl->type != LIST_column || bl->ncols == 0)
return 0;
/*
@@ -838,14 +841,13 @@ mdoc_bl_pre(MDOC_ARGS)
* screen and we want to preserve that behaviour.
*/
- for (i = 0; i < (int)n->norm->Bl.ncols - 1; i++)
- print_otag(h, TAG_COL, "sww", n->norm->Bl.cols[i]);
- print_otag(h, TAG_COL, "swW", n->norm->Bl.cols[i]);
-
+ for (i = 0; i < bl->ncols - 1; i++)
+ print_otag(h, TAG_COL, "sww", bl->cols[i]);
+ print_otag(h, TAG_COL, "swW", bl->cols[i]);
return 0;
}
- switch (n->norm->Bl.type) {
+ switch (bl->type) {
case LIST_bullet:
elemtype = TAG_UL;
cattr = "Bl-bullet";
@@ -881,14 +883,12 @@ mdoc_bl_pre(MDOC_ARGS)
break;
case LIST_tag:
cattr = "Bl-tag";
- if (n->norm->Bl.offs)
- print_otag(h, TAG_DIV, "cswl", cattr,
- n->norm->Bl.offs);
- if (n->norm->Bl.width == NULL)
+ if (bl->offs)
+ print_otag(h, TAG_DIV, "cswl", cattr, bl->offs);
+ if (bl->width == NULL)
print_otag(h, TAG_DL, "c", cattr);
else
- print_otag(h, TAG_DL, "cswl", cattr,
- n->norm->Bl.width);
+ print_otag(h, TAG_DL, "cswl", cattr, bl->width);
return 1;
case LIST_column:
elemtype = TAG_TABLE;
@@ -898,8 +898,8 @@ mdoc_bl_pre(MDOC_ARGS)
abort();
}
- if (n->norm->Bl.offs)
- print_otag(h, elemtype, "cswl", cattr, n->norm->Bl.offs);
+ if (bl->offs)
+ print_otag(h, elemtype, "cswl", cattr, bl->offs);
else
print_otag(h, elemtype, "c", cattr);
--
To unsubscribe send an email to tech+unsubscribe@mdocml.bsd.lv
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-01-28 18:55 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-01-28 12:57 Bug: crash in mdoc_bl_pre() in mdoc_html.c:843 Michael Stapelberg
2017-01-28 18:55 ` Ingo Schwarze
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).