From ee936d8dd91dc5f460c162e67bceee5ad20bb0c6 Mon Sep 17 00:00:00 2001 From: Ingo Schwarze Date: Fri, 29 Mar 2019 21:27:06 +0000 Subject: Set the maximum column index in a tbl(7) to the maximum *right* edge of any cell span, not to the maximum *left* edge, which may be smaller if the last column of the table is only reached by horizontal spans, but not by any regular cell in any row of the table. Otherwise, the algorithm calculating column widths accessed memomy after the end of the colwidth[] array, while it was trying to handle the rightmost column(s). Crash reported by Jason Thorpe via https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=54069 and via Thomas Klausner (wiz@). Christos@ Zoulas sent a (correct, but slightly confusing) patch. The patch i'm committing here is easier to understand. --- out.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/out.c b/out.c index 363d04cf..d0b0d0a2 100644 --- a/out.c +++ b/out.c @@ -1,4 +1,4 @@ -/* $Id: out.c,v 1.77 2018/12/13 11:55:47 schwarze Exp $ */ +/* $Id: out.c,v 1.78 2019/03/29 21:27:06 schwarze Exp $ */ /* * Copyright (c) 2009, 2010, 2011 Kristaps Dzonsons * Copyright (c) 2011,2014,2015,2017,2018 Ingo Schwarze @@ -149,7 +149,7 @@ tblcalc(struct rofftbl *tbl, const struct tbl_span *sp_first, gp = &first_group; for (dp = sp->first; dp != NULL; dp = dp->next) { icol = dp->layout->col; - while (icol > maxcol) + while (maxcol < icol + dp->hspans) tbl->cols[++maxcol].spacing = SIZE_MAX; col = tbl->cols + icol; col->flags |= dp->layout->flags; -- cgit v1.2.3