diff options
| author |   Ingo Schwarze <schwarze@openbsd.org> | 2015-04-21 16:14:25 +0000 |
|---|---|---|
| committer | Ingo Schwarze <schwarze@openbsd.org> | 2015-04-21 16:14:25 +0000 |
| commit | a6c2450037bcdf0d5324b4259a03eec8b4a2645c (patch) | |
| tree | c65e5a7cbe43d9fcc0f7b9bb1ed6885587f9503d | |
| parent | 5547dbf739054a891baccab82acc9dd2a1d77af5 (diff) | |
| download | mandoc-a6c2450037bcdf0d5324b4259a03eec8b4a2645c.tar.gz mandoc-a6c2450037bcdf0d5324b4259a03eec8b4a2645c.tar.zst mandoc-a6c2450037bcdf0d5324b4259a03eec8b4a2645c.zip | |
Avoid a use after free when the target node is deleted during validation.
Bug reported by jsg@.
| -rw-r--r-- | mdoc_macro.c | 29 |
1 files changed, 16 insertions, 13 deletions
diff --git a/mdoc_macro.c b/mdoc_macro.c index 8322cca5..8a811652 100644 --- a/mdoc_macro.c +++ b/mdoc_macro.c @@ -1,4 +1,4 @@ -/* $Id: mdoc_macro.c,v 1.193 2015/04/19 14:57:38 schwarze Exp $ */ +/* $Id: mdoc_macro.c,v 1.194 2015/04/21 16:14:25 schwarze Exp $ */ /* * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps@bsd.lv> * Copyright (c) 2010, 2012-2015 Ingo Schwarze <schwarze@openbsd.org> @@ -291,18 +291,21 @@ rew_pending(struct roff_man *mdoc, const struct roff_node *n) for (;;) { rew_last(mdoc, n); - switch (n->type) { - case ROFFT_HEAD: - roff_body_alloc(mdoc, n->line, n->pos, n->tok); - return; - case ROFFT_BLOCK: - break; - default: - return; - } - - if ( ! (n->flags & MDOC_BROKEN)) - return; + if (mdoc->last == n) { + switch (n->type) { + case ROFFT_HEAD: + roff_body_alloc(mdoc, n->line, n->pos, + n->tok); + return; + case ROFFT_BLOCK: + break; + default: + return; + } + if ( ! (n->flags & MDOC_BROKEN)) + return; + } else + n = mdoc->last; for (;;) { if ((n = n->parent) == NULL) |