From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from scc-mailout-kit-01.scc.kit.edu (scc-mailout-kit-01.scc.kit.edu [129.13.231.81])
	by fantadrom.bsd.lv (OpenSMTPD) with ESMTP id 6ea1b2a4
	for <tech@mandoc.bsd.lv>;
	Fri, 19 Apr 2019 23:28:44 -0500 (EST)
Received: from asta-nat.asta.uni-karlsruhe.de ([172.22.63.82] helo=hekate.usta.de)
	by scc-mailout-kit-01.scc.kit.edu with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(envelope-from <schwarze@usta.de>)
	id 1hHhcI-0004Kw-Me; Sat, 20 Apr 2019 06:28:43 +0200
Received: from donnerwolke.usta.de ([172.24.96.3])
	by hekate.usta.de with esmtp (Exim 4.77)
	(envelope-from <schwarze@usta.de>)
	id 1hHhcH-0007n1-Ke; Sat, 20 Apr 2019 06:28:41 +0200
Received: from athene.usta.de ([172.24.96.10])
	by donnerwolke.usta.de with esmtp (Exim 4.84_2)
	(envelope-from <schwarze@usta.de>)
	id 1hHhcH-0007HK-FB; Sat, 20 Apr 2019 06:28:41 +0200
Received: from localhost (athene.usta.de [local])
	by athene.usta.de (OpenSMTPD) with ESMTPA id a5062066;
	Sat, 20 Apr 2019 06:28:41 +0200 (CEST)
Date: Sat, 20 Apr 2019 06:28:41 +0200
From: Ingo Schwarze <schwarze@usta.de>
To: Stephen Gregoratto <dev@sgregoratto.me>
Cc: tech@mandoc.bsd.lv
Subject: Re: [docbook2mdoc] Segfault encountering href attr in xml preamble(s)
Message-ID: <20190420042841.GA45166@athene.usta.de>
References: <20190419042833.r5h33msa4h3pbej5@BlackBox>
X-Mailinglist: mandoc-tech
Reply-To: tech@mandoc.bsd.lv
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20190419042833.r5h33msa4h3pbej5@BlackBox>
User-Agent: Mutt/1.8.0 (2017-02-23)

Hi Stephen,

Stephen Gregoratto wrote on Fri, Apr 19, 2019 at 02:28:33PM +1000:

> I tried testing the new 1.0.0 release on some of my files and came 
> across this bug. Some refentry files encode their chosen xsl stylesheet 
> by putting it in the file itself. I believe this is to help converters 
> like xmlto(1). The format is:
> 
> <?xml-stylesheet type="text/xsl"
>    href="http://foo.tld/bar.xsl"?>
> 
> When docbook2mdoc encounters the href attribute, it eventually calls 
> xml_attrkey() in parse.c, failing in the TAILQ_INSERT_TAIL macro.

Good analysis, thanks.

Calling xml_attrkey() is still fine.
The string "<?xml-stylesheet" is supposed to be interpreted as the
beginning of an element; docbook2mdoc doesn't really distinguish
between XML elements and XML processing instructions.  And the
string "href=" is supposed to be interpreted as the beginning of
an attribute.

But inside xml_attrkey(), no processing should be done because
an unknown element does not generate a node in the node tree,
so there is no node that the attribute could be inserted into.

I think i broke this when making the NODE_* enum constants in node.h
more fine-grained, specifically when distinguishing NODE_UNKNOWN
and NODE_IGNORE.

Fixed with the commit below.

Yours,
  Ingo


Log Message:
-----------
do not crash by trying to insert an attribute into a non-existent node;
segfault reported by Stephen Gregoratto <dev at sgregoratto dot me>

Modified Files:
--------------
    docbook2mdoc:
        parse.c

Revision Data
-------------
Index: parse.c
===================================================================
RCS file: /home/cvs/mdocml/docbook2mdoc/parse.c,v
retrieving revision 1.46
retrieving revision 1.47
diff -Lparse.c -Lparse.c -u -p -r1.46 -r1.47
--- parse.c
+++ parse.c
@@ -553,7 +553,7 @@ xml_attrkey(struct parse *p, const char 
 	const char	*value;
 	enum attrkey	 key;
 
-	if (p->del > 0 || p->ncur == NODE_IGNORE || *name == '\0')
+	if (p->del > 0 || p->ncur >= NODE_UNKNOWN || *name == '\0')
 		return;
 
 	if ((p->ncur == NODE_DOCTYPE || p->ncur == NODE_ENTITY) &&
@@ -590,7 +590,7 @@ xml_attrval(struct parse *p, const char 
 {
 	struct pattr	*a;
 
-	if (p->del > 0 || p->ncur == NODE_IGNORE ||
+	if (p->del > 0 || p->ncur >= NODE_UNKNOWN ||
 	    (p->flags & PFLAG_ATTR) == 0)
 		return;
 	if ((a = TAILQ_LAST(&p->cur->attrq, pattrq)) == NULL)
--
 To unsubscribe send an email to tech+unsubscribe@mandoc.bsd.lv