Bug: crash in mdoc_bl_pre() in mdoc_html.c:843

Bug: crash in mdoc_bl_pre() in mdoc_html.c:843

[Michael Stapelberg]

I think http://mdocml.bsd.lv/cgi-bin/cvsweb/mdoc_html.c.diff?r1=1.247&r2=1.248
introduced a bug, specifically this hunk:

@@ -856,62 +770,47 @@
  * screen and we want to preserve that behaviour.
  */

- for (i = 0; i < (int)n->norm->Bl.ncols; i++) {
- bufinit(h);
- a2width(n->norm->Bl.cols[i], &su);
- if (i < (int)n->norm->Bl.ncols - 1)
- bufcat_su(h, "width", &su);
- else
- bufcat_su(h, "min-width", &su);
- PAIR_STYLE_INIT(&tag[0], h);
- print_otag(h, TAG_COL, 1, tag);
- }
+ for (i = 0; i < (int)n->norm->Bl.ncols - 1; i++)
+ print_otag(h, TAG_COL, "sww", n->norm->Bl.cols[i]);
+ print_otag(h, TAG_COL, "swW", n->norm->Bl.cols[i]);
[…]

To reproduce the crash, use:
$ curl https://manpages.debian.org/unstable/heimdal-dev/gssapi.3.en.gz
| ./mandoc -Thtml
[…]
segmentation fault (core dumped)  ./mandoc -Thtml
$ gdb mandoc core
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000560b3ac5d977 in mdoc_bl_pre (meta=0x560b3c509130,
n=0x560b3c51dd50, h=0x560b3c509260) at mdoc_html.c:843
843 print_otag(h, TAG_COL, "swW", n->norm->Bl.cols[i]);
gdb $ bt
#0  0x0000560b3ac5d977 in mdoc_bl_pre (meta=0x560b3c509130,
n=0x560b3c51dd50, h=0x560b3c509260) at mdoc_html.c:843
#1  0x0000560b3ac5c6d4 in print_mdoc_node (meta=0x560b3c509130,
n=0x560b3c51dd50, h=0x560b3c509260) at mdoc_html.c:396
#2  0x0000560b3ac5c47f in print_mdoc_nodelist (meta=0x560b3c509130,
n=0x560b3c51dd50, h=0x560b3c509260) at mdoc_html.c:337
#3  0x0000560b3ac5c743 in print_mdoc_node (meta=0x560b3c509130,
n=0x560b3c51dcb0, h=0x560b3c509260) at mdoc_html.c:406
#4  0x0000560b3ac5c47f in print_mdoc_nodelist (meta=0x560b3c509130,
n=0x560b3c51dcb0, h=0x560b3c509260) at mdoc_html.c:337
#5  0x0000560b3ac5c743 in print_mdoc_node (meta=0x560b3c509130,
n=0x560b3c51d610, h=0x560b3c509260) at mdoc_html.c:406
#6  0x0000560b3ac5c47f in print_mdoc_nodelist (meta=0x560b3c509130,
n=0x560b3c51d610, h=0x560b3c509260) at mdoc_html.c:337
#7  0x0000560b3ac5c743 in print_mdoc_node (meta=0x560b3c509130,
n=0x560b3c51d380, h=0x560b3c509260) at mdoc_html.c:406
#8  0x0000560b3ac5c47f in print_mdoc_nodelist (meta=0x560b3c509130,
n=0x560b3c51d380, h=0x560b3c509260) at mdoc_html.c:337
#9  0x0000560b3ac5c2dd in html_mdoc (arg=0x560b3c509260,
mdoc=0x560b3c509130) at mdoc_html.c:304
#10 0x0000560b3ac7b011 in parse (curp=0x7fff20668810, fd=0,
file=0x560b3ac9db71 "<stdin>") at main.c:748
#11 0x0000560b3ac7a446 in main (argc=0, argv=0x7fff20668a18) at main.c:454


-- 
Best regards,
Michael
--
 To unsubscribe send an email to tech+unsubscribe@mdocml.bsd.lv

Re: Bug: crash in mdoc_bl_pre() in mdoc_html.c:843

[Ingo Schwarze]

Hi Michael,

Thanks for the excellent report.  I didn't even need to fire up the
debugger to understand what was going on and to fix it.

Yours,
  Ingo


Log Message:
-----------
.Bl -column with zero columns is legal, so don't segfalt on it.
Bug introduced in rev. 1.248 triggered for example in gssapi(3), 
analyzed and reported by Michael <Stapelberg at debian dot org>.
Simplify the code a bit more while here.

Modified Files:
--------------
    mdocml:
        mdoc_html.c

Revision Data
-------------
Index: mdoc_html.c
===================================================================
RCS file: /home/cvs/mdocml/mdocml/mdoc_html.c,v
retrieving revision 1.261
retrieving revision 1.262
diff -Lmdoc_html.c -Lmdoc_html.c -u -p -r1.261 -r1.262
--- mdoc_html.c
+++ mdoc_html.c
@@ -817,18 +817,21 @@ mdoc_it_pre(MDOC_ARGS)
 static int
 mdoc_bl_pre(MDOC_ARGS)
 {
+	struct mdoc_bl	*bl;
 	const char	*cattr;
-	int		 i;
+	size_t		 i;
 	enum htmltag	 elemtype;
 
+	bl = &n->norm->Bl;
+
 	if (n->type == ROFFT_BODY) {
-		if (LIST_column == n->norm->Bl.type)
+		if (bl->type == LIST_column)
 			print_otag(h, TAG_TBODY, "");
 		return 1;
 	}
 
 	if (n->type == ROFFT_HEAD) {
-		if (LIST_column != n->norm->Bl.type)
+		if (bl->type != LIST_column || bl->ncols == 0)
 			return 0;
 
 		/*
@@ -838,14 +841,13 @@ mdoc_bl_pre(MDOC_ARGS)
 		 * screen and we want to preserve that behaviour.
 		 */
 
-		for (i = 0; i < (int)n->norm->Bl.ncols - 1; i++)
-			print_otag(h, TAG_COL, "sww", n->norm->Bl.cols[i]);
-		print_otag(h, TAG_COL, "swW", n->norm->Bl.cols[i]);
-
+		for (i = 0; i < bl->ncols - 1; i++)
+			print_otag(h, TAG_COL, "sww", bl->cols[i]);
+		print_otag(h, TAG_COL, "swW", bl->cols[i]);
 		return 0;
 	}
 
-	switch (n->norm->Bl.type) {
+	switch (bl->type) {
 	case LIST_bullet:
 		elemtype = TAG_UL;
 		cattr = "Bl-bullet";
@@ -881,14 +883,12 @@ mdoc_bl_pre(MDOC_ARGS)
 		break;
 	case LIST_tag:
 		cattr = "Bl-tag";
-		if (n->norm->Bl.offs)
-			print_otag(h, TAG_DIV, "cswl", cattr,
-			    n->norm->Bl.offs);
-		if (n->norm->Bl.width == NULL)
+		if (bl->offs)
+			print_otag(h, TAG_DIV, "cswl", cattr, bl->offs);
+		if (bl->width == NULL)
 			print_otag(h, TAG_DL, "c", cattr);
 		else
-			print_otag(h, TAG_DL, "cswl", cattr,
-			    n->norm->Bl.width);
+			print_otag(h, TAG_DL, "cswl", cattr, bl->width);
 		return 1;
 	case LIST_column:
 		elemtype = TAG_TABLE;
@@ -898,8 +898,8 @@ mdoc_bl_pre(MDOC_ARGS)
 		abort();
 	}
 
-	if (n->norm->Bl.offs)
-		print_otag(h, elemtype, "cswl", cattr, n->norm->Bl.offs);
+	if (bl->offs)
+		print_otag(h, elemtype, "cswl", cattr, bl->offs);
 	else
 		print_otag(h, elemtype, "c", cattr);
 
--
 To unsubscribe send an email to tech+unsubscribe@mdocml.bsd.lv