Ignore explicitly specified negative column widths rather than

wrapping around to huge numbers and risking memory exhaustion;
fixes Debian ps(1).  Bug reported by Dr. Markus Waldeck.

2 files changed, 9 insertions, 3 deletions

diff --git a/tbl_html.c b/tbl_html.c
index 06fae5eb..d59f1635 100644
--- a/tbl_html.c
+++ b/tbl_html.c
@@ -1,4 +1,4 @@
-/*	$Id: tbl_html.c,v 1.22 2017/06/12 20:14:18 schwarze Exp $ */
+/*	$Id: tbl_html.c,v 1.23 2017/07/31 16:14:10 schwarze Exp $ */
 /*
  * Copyright (c) 2011 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2014, 2015, 2017 Ingo Schwarze <schwarze@openbsd.org>
@@ -49,6 +49,9 @@ html_tbl_strlen(const char *p, void *arg)
 static size_t
 html_tbl_sulen(const struct roffsu *su, void *arg)
 {
+	if (su->scale < 0.0)
+		return 0;
+
 	switch (su->unit) {
 	case SCALE_FS:  /* 2^16 basic units */
 		return su->scale * 65536.0 / 24.0;
diff --git a/tbl_term.c b/tbl_term.c
index fd03b813..c154a0e9 100644
--- a/tbl_term.c
+++ b/tbl_term.c
@@ -1,4 +1,4 @@
-/*	$Id: tbl_term.c,v 1.56 2017/07/08 13:43:15 schwarze Exp $ */
+/*	$Id: tbl_term.c,v 1.57 2017/07/31 16:14:10 schwarze Exp $ */
 /*
  * Copyright (c) 2009, 2011 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2011,2012,2014,2015,2017 Ingo Schwarze <schwarze@openbsd.org>
@@ -51,7 +51,10 @@ static	void	tbl_word(struct termp *, const struct tbl_dat *);
 static size_t
 term_tbl_sulen(const struct roffsu *su, void *arg)
 {
-	return term_hen((const struct termp *)arg, su);
+	int	 i;
+
+	i = term_hen((const struct termp *)arg, su);
+	return i > 0 ? i : 0;
 }
 
 static size_t