Fixed null-pointer dereference.

[mandoc.git] / argv.c

diff --git a/argv.c b/argv.c
index e0ca69b9e213692eff6aa1f6093f77cda66d5d62..9499bd85dc4618a1805d9e6a9a63b53feca2428e 100644 (file)
--- a/argv.c
+++ b/argv.c
@@ -1,4 +1,4 @@
-/* $Id: argv.c,v 1.39 2009/03/08 11:41:22 kristaps Exp $ */
+/* $Id: argv.c,v 1.41 2009/03/08 12:46:38 kristaps Exp $ */

 /*
  * Copyright (c) 2008 Kristaps Dzonsons <kristaps@kth.se>
  *
 /*
  * Copyright (c) 2008 Kristaps Dzonsons <kristaps@kth.se>
  *


@@ -273,13 +273,13 @@ mdoc_argv(struct mdoc *mdoc, int line, int tok,
                return(ARGV_ERROR);
 
        if (NULL == (arg = *v)) {
                return(ARGV_ERROR);
 
        if (NULL == (arg = *v)) {

-               v = xcalloc(1, sizeof(struct mdoc_arg));
+               *v = xcalloc(1, sizeof(struct mdoc_arg));

                arg = *v;
                arg = *v;

-       }
+       } 

 
        arg->argc++;
        arg->argv = xrealloc(arg->argv, arg->argc * 
 
        arg->argc++;
        arg->argv = xrealloc(arg->argv, arg->argc * 

-                       sizeof(struct mdoc_arg));
+                       sizeof(struct mdoc_argv));

 
        (void)memcpy(&arg->argv[(int)arg->argc - 1], 
                        &tmp, sizeof(struct mdoc_argv));
 
        (void)memcpy(&arg->argv[(int)arg->argc - 1], 
                        &tmp, sizeof(struct mdoc_argv));


@@ -293,9 +293,17 @@ mdoc_argv_free(struct mdoc_arg *p)
 {
        int              i, j;
 
 {
        int              i, j;
 

-       if (p->refcnt && --(p->refcnt) > 0)
+       if (NULL == p)

                return;
 
                return;
 

+       if (p->refcnt) {
+               --(p->refcnt);
+               if (p->refcnt)
+                       return;
+       }
+
+       assert(p->argc);
+

        /* LINTED */
        for (i = 0; i < (int)p->argc; i++) {
                if (0 == p->argv[i].sz)
        /* LINTED */
        for (i = 0; i < (int)p->argc; i++) {
                if (0 == p->argv[i].sz)


@@ -303,11 +311,11 @@ mdoc_argv_free(struct mdoc_arg *p)
                /* LINTED */
                for (j = 0; j < (int)p->argv[i].sz; j++)
                        free(p->argv[i].value[j]);
                /* LINTED */
                for (j = 0; j < (int)p->argv[i].sz; j++)
                        free(p->argv[i].value[j]);

+

                free(p->argv[i].value);
        }
 
                free(p->argv[i].value);
        }
 

-       if (p->argc)
-               free(p->argv);
+       free(p->argv);

        free(p);
 }
 
        free(p);
 }
 


@@ -742,7 +750,7 @@ argv_multi(struct mdoc *mdoc, int line,
                        v->value = xrealloc(v->value, 
                                (v->sz + 5) * sizeof(char *));
 
                        v->value = xrealloc(v->value, 
                                (v->sz + 5) * sizeof(char *));
 

-               v->value[(int)v->sz] = p;
+               v->value[(int)v->sz] = xstrdup(p);

        }
 
        if (v->sz)
        }
 
        if (v->sz)


@@ -770,7 +778,7 @@ argv_opt_single(struct mdoc *mdoc, int line,
 
        v->sz = 1;
        v->value = xcalloc(1, sizeof(char *));
 
        v->sz = 1;
        v->value = xcalloc(1, sizeof(char *));

-       v->value[0] = p;
+       v->value[0] = xstrdup(p);

        return(1);
 }
 
        return(1);
 }
 


@@ -795,7 +803,7 @@ argv_single(struct mdoc *mdoc, int line,
 
        v->sz = 1;
        v->value = xcalloc(1, sizeof(char *));
 
        v->sz = 1;
        v->value = xcalloc(1, sizeof(char *));

-       v->value[0] = p;
+       v->value[0] = xstrdup(p);

        return(1);
 }
 
        return(1);
 }