tech@mandoc.bsd.lv
 help / color / mirror / Atom feed
From: Michael Stapelberg <stapelberg@debian.org>
To: tech@mdocml.bsd.lv
Subject: Bug: crash in mdoc_bl_pre() in mdoc_html.c:843
Date: Sat, 28 Jan 2017 13:57:37 +0100	[thread overview]
Message-ID: <CANnVG6kDsqN3OuJ=ZsdWyh4R3z+vLCum2VF6yVg4+_crB5jv7A@mail.gmail.com> (raw)

I think http://mdocml.bsd.lv/cgi-bin/cvsweb/mdoc_html.c.diff?r1=1.247&r2=1.248
introduced a bug, specifically this hunk:

@@ -856,62 +770,47 @@
  * screen and we want to preserve that behaviour.
  */

- for (i = 0; i < (int)n->norm->Bl.ncols; i++) {
- bufinit(h);
- a2width(n->norm->Bl.cols[i], &su);
- if (i < (int)n->norm->Bl.ncols - 1)
- bufcat_su(h, "width", &su);
- else
- bufcat_su(h, "min-width", &su);
- PAIR_STYLE_INIT(&tag[0], h);
- print_otag(h, TAG_COL, 1, tag);
- }
+ for (i = 0; i < (int)n->norm->Bl.ncols - 1; i++)
+ print_otag(h, TAG_COL, "sww", n->norm->Bl.cols[i]);
+ print_otag(h, TAG_COL, "swW", n->norm->Bl.cols[i]);
[…]

To reproduce the crash, use:
$ curl https://manpages.debian.org/unstable/heimdal-dev/gssapi.3.en.gz
| ./mandoc -Thtml
[…]
segmentation fault (core dumped)  ./mandoc -Thtml
$ gdb mandoc core
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000560b3ac5d977 in mdoc_bl_pre (meta=0x560b3c509130,
n=0x560b3c51dd50, h=0x560b3c509260) at mdoc_html.c:843
843 print_otag(h, TAG_COL, "swW", n->norm->Bl.cols[i]);
gdb $ bt
#0  0x0000560b3ac5d977 in mdoc_bl_pre (meta=0x560b3c509130,
n=0x560b3c51dd50, h=0x560b3c509260) at mdoc_html.c:843
#1  0x0000560b3ac5c6d4 in print_mdoc_node (meta=0x560b3c509130,
n=0x560b3c51dd50, h=0x560b3c509260) at mdoc_html.c:396
#2  0x0000560b3ac5c47f in print_mdoc_nodelist (meta=0x560b3c509130,
n=0x560b3c51dd50, h=0x560b3c509260) at mdoc_html.c:337
#3  0x0000560b3ac5c743 in print_mdoc_node (meta=0x560b3c509130,
n=0x560b3c51dcb0, h=0x560b3c509260) at mdoc_html.c:406
#4  0x0000560b3ac5c47f in print_mdoc_nodelist (meta=0x560b3c509130,
n=0x560b3c51dcb0, h=0x560b3c509260) at mdoc_html.c:337
#5  0x0000560b3ac5c743 in print_mdoc_node (meta=0x560b3c509130,
n=0x560b3c51d610, h=0x560b3c509260) at mdoc_html.c:406
#6  0x0000560b3ac5c47f in print_mdoc_nodelist (meta=0x560b3c509130,
n=0x560b3c51d610, h=0x560b3c509260) at mdoc_html.c:337
#7  0x0000560b3ac5c743 in print_mdoc_node (meta=0x560b3c509130,
n=0x560b3c51d380, h=0x560b3c509260) at mdoc_html.c:406
#8  0x0000560b3ac5c47f in print_mdoc_nodelist (meta=0x560b3c509130,
n=0x560b3c51d380, h=0x560b3c509260) at mdoc_html.c:337
#9  0x0000560b3ac5c2dd in html_mdoc (arg=0x560b3c509260,
mdoc=0x560b3c509130) at mdoc_html.c:304
#10 0x0000560b3ac7b011 in parse (curp=0x7fff20668810, fd=0,
file=0x560b3ac9db71 "<stdin>") at main.c:748
#11 0x0000560b3ac7a446 in main (argc=0, argv=0x7fff20668a18) at main.c:454


-- 
Best regards,
Michael
--
 To unsubscribe send an email to tech+unsubscribe@mdocml.bsd.lv

             reply	other threads:[~2017-01-28 12:57 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-01-28 12:57 Michael Stapelberg [this message]
2017-01-28 18:55 ` Ingo Schwarze

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CANnVG6kDsqN3OuJ=ZsdWyh4R3z+vLCum2VF6yVg4+_crB5jv7A@mail.gmail.com' \
    --to=stapelberg@debian.org \
    --cc=tech@mdocml.bsd.lv \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).