Avoid out-of-bounds read access before the beginning of the

[mandoc.git] / eqn_html.c

diff --git a/eqn_html.c b/eqn_html.c
index 738286844bf924b00e8143f25398e6eaec506e3b..f29733613bb96386809ffb89c2255c0d9118d17d 100644 (file)
--- a/eqn_html.c
+++ b/eqn_html.c
@@ -1,6 +1,6 @@
-/*     $Id: eqn_html.c,v 1.8 2014/10/10 08:44:24 kristaps Exp $ */
+/*     $Id: eqn_html.c,v 1.10 2014/10/12 19:31:41 schwarze Exp $ */

 /*
 /*

- * Copyright (c) 2011 Kristaps Dzonsons <kristaps@bsd.lv>
+ * Copyright (c) 2011, 2014 Kristaps Dzonsons <kristaps@bsd.lv>

  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above


@@ -47,14 +47,16 @@ eqn_box(struct html *p, const struct eqn_box *bp)
        if (EQN_MATRIX == bp->type) {
                if (NULL == bp->first)
                        goto out;
        if (EQN_MATRIX == bp->type) {
                if (NULL == bp->first)
                        goto out;

-               assert(EQN_LIST == bp->first->type);
+               if (EQN_LIST != bp->first->type) {
+                       eqn_box(p, bp->first);
+                       goto out;
+               }

                if (NULL == (parent = bp->first->first))
                        goto out;
                if (NULL == (parent = bp->first->first))
                        goto out;

-               assert(EQN_PILE == parent->type);

                /* Estimate the number of rows, first. */
                if (NULL == (child = parent->first))
                        goto out;
                /* Estimate the number of rows, first. */
                if (NULL == (child = parent->first))
                        goto out;

-               for (rows = 0; NULL != child; rows++) 
+               for (rows = 0; NULL != child; rows++)

                        child = child->next;
                /* Print row-by-row. */
                post = print_otag(p, TAG_MTABLE, 0, NULL);
                        child = child->next;
                /* Print row-by-row. */
                post = print_otag(p, TAG_MTABLE, 0, NULL);


@@ -70,12 +72,12 @@ eqn_box(struct html *p, const struct eqn_box *bp)
                                }
                                cell = print_otag
                                        (p, TAG_MTD, 0, NULL);
                                }
                                cell = print_otag
                                        (p, TAG_MTD, 0, NULL);

-                               /* 
+                               /*

                                 * If we have no data for this
                                 * particular cell, then print a
                                 * placeholder and continue--don't puke.
                                 */
                                 * If we have no data for this
                                 * particular cell, then print a
                                 * placeholder and continue--don't puke.
                                 */

-                               if (NULL != child) 
+                               if (NULL != child)

                                        eqn_box(p, child->first);
                                print_tagq(p, cell);
                                parent = parent->next;
                                        eqn_box(p, child->first);
                                print_tagq(p, cell);
                                parent = parent->next;


@@ -126,8 +128,10 @@ eqn_box(struct html *p, const struct eqn_box *bp)
 
        if (EQN_PILE == bp->type) {
                assert(NULL == post);
 
        if (EQN_PILE == bp->type) {
                assert(NULL == post);

-               post = print_otag(p, TAG_MTABLE, 0, NULL);
-       } else if (bp->parent && EQN_PILE == bp->parent->type) {
+               if (bp->first != NULL && bp->first->type == EQN_LIST)
+                       post = print_otag(p, TAG_MTABLE, 0, NULL);
+       } else if (bp->type == EQN_LIST &&
+           bp->parent && bp->parent->type == EQN_PILE) {

                assert(NULL == post);
                post = print_otag(p, TAG_MTR, 0, NULL);
                print_otag(p, TAG_MTD, 0, NULL);
                assert(NULL == post);
                post = print_otag(p, TAG_MTR, 0, NULL);
                print_otag(p, TAG_MTD, 0, NULL);


@@ -137,14 +141,14 @@ eqn_box(struct html *p, const struct eqn_box *bp)
                assert(NULL == post);
                post = print_otag(p, TAG_MI, 0, NULL);
                print_text(p, bp->text);
                assert(NULL == post);
                post = print_otag(p, TAG_MI, 0, NULL);
                print_text(p, bp->text);

-       } else if (NULL == post) { 
+       } else if (NULL == post) {

                if (NULL != bp->left || NULL != bp->right) {
                        PAIR_INIT(&tag[0], ATTR_OPEN,
                if (NULL != bp->left || NULL != bp->right) {
                        PAIR_INIT(&tag[0], ATTR_OPEN,

-                               NULL == bp->left ? "" : bp->left);
+                           NULL == bp->left ? "" : bp->left);

                        PAIR_INIT(&tag[1], ATTR_CLOSE,
                        PAIR_INIT(&tag[1], ATTR_CLOSE,

-                               NULL == bp->right ? "" : bp->right);
+                           NULL == bp->right ? "" : bp->right);

                        post = print_otag(p, TAG_MFENCED, 2, tag);
                        post = print_otag(p, TAG_MFENCED, 2, tag);

-               } 
+               }

                if (NULL == post)
                        post = print_otag(p, TAG_MROW, 0, NULL);
                else
                if (NULL == post)
                        post = print_otag(p, TAG_MROW, 0, NULL);
                else


@@ -158,7 +162,7 @@ out:
                t = print_otag(p, TAG_MO, 0, NULL);
                print_text(p, bp->bottom);
                print_tagq(p, t);
                t = print_otag(p, TAG_MO, 0, NULL);
                print_text(p, bp->bottom);
                print_tagq(p, t);

-       } 
+       }

        if (NULL != bp->top) {
                t = print_otag(p, TAG_MO, 0, NULL);
                print_text(p, bp->top);
        if (NULL != bp->top) {
                t = print_otag(p, TAG_MO, 0, NULL);
                print_text(p, bp->top);