Division by zero

[Kristaps Dzonsons <kristaps@bsd.lv>]

[-- Attachment #1: Type: text/plain, Size: 514 bytes --]

Hi,

Enclosed is a patch to handle roff.c's division by zero.  This was found 
(indirectly) when playing with mandoc's new support for inline equations.

groff(1) seems to actually warn us when this happens--if we're to do the 
same, we'll need to pass the mparse function through to the offending 
function.

By the way, upon an audit, I see that term_ps.c is vulnerable to 
division by zero if the "scale" parameter in termp_ps is zero.  However, 
we don't ever seem to re-set that, so it's ok.

Best,

Kristaps

[-- Attachment #2: divbyzero.patch --]
[-- Type: text/plain, Size: 1172 bytes --]

? .DS_Store
? .test.1.swp
? Makefile.local
? TEST.sh
? TEST.sh.out
? bar.1
? cgi-doc.diff
? cgi.h
? config.h
? config.log
? configure.local
? demandoc
? ditto.1
? divbyzero.patch
? eqn-test.1
? eqn-test.1.html
? eqn.2.patch
? eqn.bak.c
? eqn.patch
? foo
? foo.1
? foo.1.html
? foo.1.ps
? foo.2
? foo.2.html
? foo.3
? foo.3.html
? foo.4
? foo.4.html
? foo.5
? foo.5.html
? foo.5.ps
? foo.sh
? makewhatis
? man.cgi
? mandoc
? plockstat.1
? preconv
? term.diff
? test-dirent-namlen.dSYM
? test-fgetln.dSYM
? test-fts.dSYM
? test-getsubopt.dSYM
? test-mmap.dSYM
? test-sqlite3.dSYM
? test-strcasestr.dSYM
? test-strlcat.dSYM
? test-strlcpy.dSYM
? test-strptime.dSYM
? test-strsep.dSYM
? test-wchar.dSYM
? test.1
Index: roff.c
===================================================================
RCS file: /usr/vhosts/mdocml.bsd.lv/cvs/mdocml/roff.c,v
retrieving revision 1.231
diff -u -p -r1.231 roff.c
--- roff.c	16 Oct 2014 01:28:38 -0000	1.231
+++ roff.c	19 Oct 2014 20:54:47 -0000
@@ -1545,6 +1545,8 @@ roff_evalnum(const char *v, int *pos, in
 			*res *= operand2;
 			break;
 		case '/':
+			if (0.0 == operand2)
+				break;
 			*res /= operand2;
 			break;
 		case '%':