Protect against malicious manual pages containing .ll requests with

[mandoc.git] / mdoc.c

diff --git a/mdoc.c b/mdoc.c
index d08a85259414854a7221fdb17fdd44bb18911bde..71803531ddfbaa30dc0a963c8eacd006814e5ecb 100644 (file)
--- a/mdoc.c
+++ b/mdoc.c
@@ -1,4 +1,4 @@
-/*     $Id: mdoc.c,v 1.266 2017/06/07 20:58:49 schwarze Exp $ */
+/*     $Id: mdoc.c,v 1.268 2017/08/11 16:56:21 schwarze Exp $ */
 /*
  * Copyright (c) 2008, 2009, 2010, 2011 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010, 2012-2017 Ingo Schwarze <schwarze@openbsd.org>
@@ -179,6 +179,7 @@ static int
 mdoc_ptext(struct roff_man *mdoc, int line, char *buf, int offs)
 {
        struct roff_node *n;
+       const char       *cp, *sp;
        char             *c, *ws, *end;
 
        n = mdoc->last;
@@ -244,15 +245,30 @@ mdoc_ptext(struct roff_man *mdoc, int line, char *buf, int offs)
                mandoc_msg(MANDOCERR_SPACE_EOL, mdoc->parse,
                    line, (int)(ws-buf), NULL);
 
+       /*
+        * Blank lines are allowed in no-fill mode
+        * and cancel preceding \c,
+        * but add a single vertical space elsewhere.
+        */
+
        if (buf[offs] == '\0' && ! (mdoc->flags & MDOC_LITERAL)) {
+               switch (mdoc->last->type) {
+               case ROFFT_TEXT:
+                       sp = mdoc->last->string;
+                       cp = end = strchr(sp, '\0') - 2;
+                       if (cp < sp || cp[0] != '\\' || cp[1] != 'c')
+                               break;
+                       while (cp > sp && cp[-1] == '\\')
+                               cp--;
+                       if ((end - cp) % 2)
+                               break;
+                       *end = '\0';
+                       return 1;
+               default:
+                       break;
+               }
                mandoc_msg(MANDOCERR_FI_BLANK, mdoc->parse,
                    line, (int)(c - buf), NULL);
-
-               /*
-                * Insert a `sp' in the case of a blank line.  Technically,
-                * blank lines aren't allowed, but enough manuals assume this
-                * behaviour that we want to work around it.
-                */
                roff_elem_alloc(mdoc, line, offs, ROFF_sp);
                mdoc->last->flags |= NODE_VALID | NODE_ENDED;
                mdoc->next = ROFF_NEXT_SIBLING;
@@ -281,8 +297,8 @@ mdoc_ptext(struct roff_man *mdoc, int line, char *buf, int offs)
                if (end - c < 3)
                        break;
                if (c[1] != ' ' ||
-                   isalpha((unsigned char)c[-2]) == 0 ||
-                   isalpha((unsigned char)c[-1]) == 0 ||
+                   isalnum((unsigned char)c[-2]) == 0 ||
+                   isalnum((unsigned char)c[-1]) == 0 ||
                    (c[-2] == 'n' && c[-1] == 'c') ||
                    (c[-2] == 'v' && c[-1] == 's'))
                        continue;