When we open a new .while loop, let's not attempt to close out

another enclosing .while loop at the same time.
Instead, postpone the closing until the next iteration of ROFF_RERUN.

This prevents one-line constructions like ".while 0 .while 0 something"
and ".while rx .while rx .rr x" (which admittedly aren't particularly
useful) from dying of abort(3), which was a bug tb@ found with afl(1).

1 files changed, 5 insertions, 3 deletions

diff --git a/roff.c b/roff.c
index 29166fd4..328855c0 100644
--- a/roff.c
+++ b/roff.c
@@ -1,4 +1,4 @@
-/* $Id: roff.c,v 1.382 2022/04/24 13:38:46 schwarze Exp $ */
+/* $Id: roff.c,v 1.383 2022/04/24 17:40:22 schwarze Exp $ */
 /*
  * Copyright (c) 2010-2015, 2017-2022 Ingo Schwarze <schwarze@openbsd.org>
  * Copyright (c) 2008-2012, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
@@ -2433,9 +2433,11 @@ roff_cond_sub(ROFF_ARGS)
 			}
 		}
 	} else if (t != TOKEN_NONE &&
-	    (rr || roffs[t].flags & ROFFMAC_STRUCT))
+	    (rr || roffs[t].flags & ROFFMAC_STRUCT)) {
 		irc |= (*roffs[t].proc)(r, t, buf, ln, ppos, pos, offs);
-	else
+		if (irc & ROFF_WHILE)
+			irc &= ~(ROFF_LOOPCONT | ROFF_LOOPEXIT);
+	} else
 		irc |= rr ? ROFF_CONT : ROFF_IGN;
 	return irc;
 }