Do not access a NULL pointer if a matrix or square root are empty.

Crashes found by tb@ with afl(1).

9 files changed, 45 insertions, 13 deletions

diff --git a/NEWS b/NEWS
index 7d64b155..687c19b5 100644
--- a/NEWS
+++ b/NEWS
@@ -1,4 +1,4 @@
-$Id: NEWS,v 1.18 2017/02/11 15:47:16 schwarze Exp $
+$Id: NEWS,v 1.19 2017/02/12 14:19:01 schwarze Exp $
 
 This file lists the most important changes in the mdocml.bsd.lv distribution.
 
@@ -61,6 +61,8 @@ Changes in version 1.14.1, released on February XXX, 2017
    block-end macro calling another block-end macro.
  * mdoc(7): Fix NULL dereference if the only child of the head
    of the first .Sh was an empty in-line macro.
+ * eqn(7): Fix NULL dereference in the terminal formatter
+   for empty matrices and empty square roots.
  * mdoc(7): Fix an assertion failure for a .Bd without a type that
    breaks another block.
  * mdoc(7): Fix an assertion failure caused by .Bl -column without .It
diff --git a/eqn_term.c b/eqn_term.c
index 5f2818b4..43580152 100644
--- a/eqn_term.c
+++ b/eqn_term.c
@@ -1,7 +1,7 @@
-/*	$Id: eqn_term.c,v 1.8 2015/01/01 15:36:08 schwarze Exp $ */
+/*	$Id: eqn_term.c,v 1.9 2017/02/12 14:19:01 schwarze Exp $ */
 /*
  * Copyright (c) 2011 Kristaps Dzonsons <kristaps@bsd.lv>
- * Copyright (c) 2014, 2015 Ingo Schwarze <schwarze@openbsd.org>
+ * Copyright (c) 2014, 2015, 2017 Ingo Schwarze <schwarze@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -68,8 +68,10 @@ eqn_box(struct termp *p, const struct eqn_box *bp)
 
 	if (bp->pos == EQNPOS_SQRT) {
 		term_word(p, "sqrt");
-		p->flags |= TERMP_NOSPACE;
-		eqn_box(p, bp->first);
+		if (bp->first != NULL) {
+			p->flags |= TERMP_NOSPACE;
+			eqn_box(p, bp->first);
+		}
 	} else if (bp->type == EQN_SUBEXPR) {
 		child = bp->first;
 		eqn_box(p, child);
@@ -93,7 +95,8 @@ eqn_box(struct termp *p, const struct eqn_box *bp)
 		}
 	} else {
 		child = bp->first;
-		if (bp->type == EQN_MATRIX && child->type == EQN_LIST)
+		if (bp->type == EQN_MATRIX &&
+		    child != NULL && child->type == EQN_LIST)
 			child = child->first;
 		while (child != NULL) {
 			eqn_box(p,
diff --git a/regress/eqn/matrix/Makefile b/regress/eqn/matrix/Makefile
index a48306f2..8c2b50bb 100644
--- a/regress/eqn/matrix/Makefile
+++ b/regress/eqn/matrix/Makefile
@@ -1,6 +1,6 @@
 # $OpenBSD: Makefile,v 1.1.1.1 2015/01/01 12:53:46 schwarze Exp $
 
-REGRESS_TARGETS	 = basic
-HTML_TARGETS	 = basic
+REGRESS_TARGETS	 = basic empty
+HTML_TARGETS	 = basic empty
 
 .include <bsd.regress.mk>
diff --git a/regress/eqn/matrix/empty.in b/regress/eqn/matrix/empty.in
new file mode 100644
index 00000000..fda70b2f
--- /dev/null
+++ b/regress/eqn/matrix/empty.in
@@ -0,0 +1,17 @@
+.Dd February 12, 2017
+.Dt MATRIX-EMPTY 1
+.Os OpenBSD
+.Sh NAME
+.Nm matrix-empty
+.Nd empty matrixes
+.Sh DESCRIPTION
+initial text
+.EQ
+left (
+matrix { }
+right )
+left (
+matrix
+right )
+.EN
+final text
diff --git a/regress/eqn/matrix/empty.out_ascii b/regress/eqn/matrix/empty.out_ascii
new file mode 100644
index 00000000..ca555848
--- /dev/null
+++ b/regress/eqn/matrix/empty.out_ascii
@@ -0,0 +1,9 @@
+MATRIX-EMPTY(1)             General Commands Manual            MATRIX-EMPTY(1)
+
+NNAAMMEE
+     mmaattrriixx--eemmppttyy - empty matrixes
+
+DDEESSCCRRIIPPTTIIOONN
+     initial text () () final text
+
+OpenBSD                        February 12, 2017                       OpenBSD
diff --git a/regress/eqn/matrix/empty.out_html b/regress/eqn/matrix/empty.out_html
new file mode 100644
index 00000000..4578d361
--- /dev/null
+++ b/regress/eqn/matrix/empty.out_html
@@ -0,0 +1 @@
+<mrow><mfenced open="(" close=")"><mrow></mrow></mfenced><mfenced open="(" close=")"><mrow></mrow></mfenced></mrow>
diff --git a/regress/eqn/unary/sqrt.in b/regress/eqn/unary/sqrt.in
index 359c3d7b..b416da7c 100644
--- a/regress/eqn/unary/sqrt.in
+++ b/regress/eqn/unary/sqrt.in
@@ -1,4 +1,4 @@
-.Dd October 10, 2014
+.Dd February 12, 2017
 .Dt UNARY-SQRT 1
 .Os OpenBSD
 .Sh NAME
@@ -7,6 +7,6 @@
 .Sh DESCRIPTION
 initial text
 .EQ
-r = sqrt { x sup 2 + y sup 2 }
+r = sqrt { x sup 2 + y sup 2 } + sqrt { } + sqrt
 .EN
 final text
diff --git a/regress/eqn/unary/sqrt.out_ascii b/regress/eqn/unary/sqrt.out_ascii
index 104df229..f109b770 100644
--- a/regress/eqn/unary/sqrt.out_ascii
+++ b/regress/eqn/unary/sqrt.out_ascii
@@ -4,6 +4,6 @@ NNAAMMEE
      uunnaarryy--ssqqrrtt - square root
 
 DDEESSCCRRIIPPTTIIOONN
-     initial text r = sqrt(x^2 + y^2) final text
+     initial text r = sqrt(x^2 + y^2) + sqrt() + sqrt final text
 
-OpenBSD                        October 10, 2014                        OpenBSD
+OpenBSD                        February 12, 2017                       OpenBSD
diff --git a/regress/eqn/unary/sqrt.out_html b/regress/eqn/unary/sqrt.out_html
index b868474d..a828ff1d 100644
--- a/regress/eqn/unary/sqrt.out_html
+++ b/regress/eqn/unary/sqrt.out_html
@@ -1 +1 @@
-<mrow><mi>r</mi><mi>=</mi><msqrt><mrow><msup><mi>x</mi><mi>2</mi></msup><mi>+</mi><msup><mi>y</mi><mi>2</mi></msup></mrow></msqrt></mrow>
+<mrow><mi>r</mi><mi>=</mi><msqrt><mrow><msup><mi>x</mi><mi>2</mi></msup><mi>+</mi><msup><mi>y</mi><mi>2</mi></msup></mrow></msqrt><mi>+</mi><msqrt><mrow></mrow></msqrt><mi>+</mi><msqrt></msqrt></mrow>