Do not access a NULL pointer if a matrix or square root are empty.

Crashes found by tb@ with afl(1).

diff --git a/NEWS b/NEWS
index 7d64b155228bd2850bd9be0a4e4975c901dfdb10..687c19b5b57c94b931cbb328d9c051ab42902bb3 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,4 +1,4 @@
-$Id: NEWS,v 1.18 2017/02/11 15:47:16 schwarze Exp $
+$Id: NEWS,v 1.19 2017/02/12 14:19:01 schwarze Exp $
 
 This file lists the most important changes in the mdocml.bsd.lv distribution.
 
@@ -61,6 +61,8 @@ Changes in version 1.14.1, released on February XXX, 2017
    block-end macro calling another block-end macro.
  * mdoc(7): Fix NULL dereference if the only child of the head
    of the first .Sh was an empty in-line macro.
+ * eqn(7): Fix NULL dereference in the terminal formatter
+   for empty matrices and empty square roots.
  * mdoc(7): Fix an assertion failure for a .Bd without a type that
    breaks another block.
  * mdoc(7): Fix an assertion failure caused by .Bl -column without .It

diff --git a/eqn_term.c b/eqn_term.c
index 5f2818b4052b4d68f17a8d7e64c59edd56de0a46..4358015274500b97b842b553e419446b28fad379 100644 (file)
--- a/eqn_term.c
+++ b/eqn_term.c
@@ -1,7 +1,7 @@
-/*     $Id: eqn_term.c,v 1.8 2015/01/01 15:36:08 schwarze Exp $ */
+/*     $Id: eqn_term.c,v 1.9 2017/02/12 14:19:01 schwarze Exp $ */
 /*
  * Copyright (c) 2011 Kristaps Dzonsons <kristaps@bsd.lv>
- * Copyright (c) 2014, 2015 Ingo Schwarze <schwarze@openbsd.org>
+ * Copyright (c) 2014, 2015, 2017 Ingo Schwarze <schwarze@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -68,8 +68,10 @@ eqn_box(struct termp *p, const struct eqn_box *bp)
 
        if (bp->pos == EQNPOS_SQRT) {
                term_word(p, "sqrt");
-               p->flags |= TERMP_NOSPACE;
-               eqn_box(p, bp->first);
+               if (bp->first != NULL) {
+                       p->flags |= TERMP_NOSPACE;
+                       eqn_box(p, bp->first);
+               }
        } else if (bp->type == EQN_SUBEXPR) {
                child = bp->first;
                eqn_box(p, child);
@@ -93,7 +95,8 @@ eqn_box(struct termp *p, const struct eqn_box *bp)
                }
        } else {
                child = bp->first;
-               if (bp->type == EQN_MATRIX && child->type == EQN_LIST)
+               if (bp->type == EQN_MATRIX &&
+                   child != NULL && child->type == EQN_LIST)
                        child = child->first;
                while (child != NULL) {
                        eqn_box(p,

diff --git a/regress/eqn/matrix/Makefile b/regress/eqn/matrix/Makefile
index a48306f24dc8debab8c7f7fbceffa64ac22ba194..8c2b50bba281e195c702a355a3b0f01faeff5583 100644 (file)
--- a/regress/eqn/matrix/Makefile
+++ b/regress/eqn/matrix/Makefile
@@ -1,6 +1,6 @@
 # $OpenBSD: Makefile,v 1.1.1.1 2015/01/01 12:53:46 schwarze Exp $
 
-REGRESS_TARGETS         = basic
-HTML_TARGETS    = basic
+REGRESS_TARGETS         = basic empty
+HTML_TARGETS    = basic empty
 
 .include <bsd.regress.mk>

diff --git a/regress/eqn/matrix/empty.in b/regress/eqn/matrix/empty.in
new file mode 100644 (file)
index 0000000..fda70b2
--- /dev/null
+++ b/regress/eqn/matrix/empty.in
@@ -0,0 +1,17 @@
+.Dd February 12, 2017
+.Dt MATRIX-EMPTY 1
+.Os OpenBSD
+.Sh NAME
+.Nm matrix-empty
+.Nd empty matrixes
+.Sh DESCRIPTION
+initial text
+.EQ
+left (
+matrix { }
+right )
+left (
+matrix
+right )
+.EN
+final text

diff --git a/regress/eqn/matrix/empty.out_ascii b/regress/eqn/matrix/empty.out_ascii
new file mode 100644 (file)
index 0000000..ca55584
--- /dev/null
+++ b/regress/eqn/matrix/empty.out_ascii
@@ -0,0 +1,9 @@
+MATRIX-EMPTY(1)             General Commands Manual            MATRIX-EMPTY(1)
+
+N\bNA\bAM\bME\bE
+     m\bma\bat\btr\bri\bix\bx-\b-e\bem\bmp\bpt\bty\by - empty matrixes
+
+D\bDE\bES\bSC\bCR\bRI\bIP\bPT\bTI\bIO\bON\bN
+     initial text () () final text
+
+OpenBSD                        February 12, 2017                       OpenBSD

diff --git a/regress/eqn/matrix/empty.out_html b/regress/eqn/matrix/empty.out_html
new file mode 100644 (file)
index 0000000..4578d36
--- /dev/null
+++ b/regress/eqn/matrix/empty.out_html
@@ -0,0 +1 @@
+<mrow><mfenced open="(" close=")"><mrow></mrow></mfenced><mfenced open="(" close=")"><mrow></mrow></mfenced></mrow>

diff --git a/regress/eqn/unary/sqrt.in b/regress/eqn/unary/sqrt.in
index 359c3d7b66465a90bec17b5627f59ae860694bc7..b416da7c2cff85dfa20bf4cb2cfdb906c038145e 100644 (file)
--- a/regress/eqn/unary/sqrt.in
+++ b/regress/eqn/unary/sqrt.in
@@ -1,4 +1,4 @@
-.Dd October 10, 2014
+.Dd February 12, 2017
 .Dt UNARY-SQRT 1
 .Os OpenBSD
 .Sh NAME
@@ -7,6 +7,6 @@
 .Sh DESCRIPTION
 initial text
 .EQ
-r = sqrt { x sup 2 + y sup 2 }
+r = sqrt { x sup 2 + y sup 2 } + sqrt { } + sqrt
 .EN
 final text

diff --git a/regress/eqn/unary/sqrt.out_ascii b/regress/eqn/unary/sqrt.out_ascii
index 104df229b53ffd1a0244a49c35bf965c53ae1044..f109b77055aa521efe6536386016f13ff4ea1aea 100644 (file)
--- a/regress/eqn/unary/sqrt.out_ascii
+++ b/regress/eqn/unary/sqrt.out_ascii
@@ -4,6 +4,6 @@ N\bNA\bAM\bME\bE
      u\bun\bna\bar\bry\by-\b-s\bsq\bqr\brt\bt - square root
 
 D\bDE\bES\bSC\bCR\bRI\bIP\bPT\bTI\bIO\bON\bN
-     initial text r = sqrt(x^2 + y^2) final text
+     initial text r = sqrt(x^2 + y^2) + sqrt() + sqrt final text
 
-OpenBSD                        October 10, 2014                        OpenBSD
+OpenBSD                        February 12, 2017                       OpenBSD

diff --git a/regress/eqn/unary/sqrt.out_html b/regress/eqn/unary/sqrt.out_html
index b868474dfb7c8c71a3064ac4be3cefd80e741c32..a828ff1dc4850ad25edd66b28db0b7ee3e1b2bac 100644 (file)
--- a/regress/eqn/unary/sqrt.out_html
+++ b/regress/eqn/unary/sqrt.out_html
@@ -1 +1 @@
-<mrow><mi>r</mi><mi>=</mi><msqrt><mrow><msup><mi>x</mi><mi>2</mi></msup><mi>+</mi><msup><mi>y</mi><mi>2</mi></msup></mrow></msqrt></mrow>
+<mrow><mi>r</mi><mi>=</mi><msqrt><mrow><msup><mi>x</mi><mi>2</mi></msup><mi>+</mi><msup><mi>y</mi><mi>2</mi></msup></mrow></msqrt><mi>+</mi><msqrt><mrow></mrow></msqrt><mi>+</mi><msqrt></msqrt></mrow>