help / color / mirror / Atom feed
From: Stephen Gregoratto <>
Subject: [mandoc] segfault due to missing tbl layout
Date: Tue, 4 Jun 2019 12:53:29 +1000
Message-ID: <20190604025329.4h75kp6lq7dyglcn@BlackBox> (raw)

[-- Attachment #1: Type: text/plain, Size: 1354 bytes --]

Here's an interesting bug I found in the wild. First, some backstory.
The aerc[1] email client uses scdoc[2] to generate its manpages (same
author). Scdoc files are kinda like markdown, but they have a funky way
of setting out tables (see the TABLES section of scdoc(5)[3]).

So, the aerc-config document has a long table for command keys, and in
the middle of it the author forgot to set the alignment for a cell. I'm
attaching the formatted document, but I can trigger the same bug with
this (bug.5):

  l c
  l l.
  Foo	Bar
  Foo	Bar

This occurs on Arch Linux and OpenBSD 6.5, with the latest changes from
CVS. This is the output from GDB:

#0  0x000055632eb7ff52 in tbl_hrule (tp=0x55632edc6d00, spp=0x55632edc31a0, sp=0x55632edc31a0, spn=0x55632edc3310, flags=1) at tbl_term.c:626
626                     col = tp->tbl.cols + cp->col;
(gdb) p tp->tbl.cols
$2 = (struct roffcol *) 0x55632edcb890
(gdb) p cp->col
Cannot access memory at address 0x24

I've tested this with groff and Plan 9 troff/tbl and they handle this

Stephen Gregoratto
PGP: 3FC6 3D0E 2801 C348 1C44 2D34 A80C 0F8E 8BAB EC8B

[-- Attachment #2: bug.5 --]
[-- Type: application/x-troff-man, Size: 59 bytes --]

[-- Attachment #3: aerc-config.5 --]
[-- Type: application/x-troff-man, Size: 9793 bytes --]

             reply	other threads:[~2019-06-04  2:53 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-06-04  2:53 Stephen Gregoratto [this message]
2019-06-11 16:23 ` Ingo Schwarze
2019-06-12 15:30   ` Stephen Gregoratto

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190604025329.4h75kp6lq7dyglcn@BlackBox \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This inbox may be cloned and mirrored by anyone:

	git clone --mirror

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V1 mandoc-tech mandoc-tech/ \
	public-inbox-index mandoc-tech

Example config snippet for mirrors.
Newsgroup available over NNTP:

AGPL code for this site: git clone