diff options
author | 2014-08-18 16:36:54 +0000 | |
---|---|---|
committer | 2014-08-18 16:36:54 +0000 | |
commit | b1980ad8f95c0b32e91275767b1c1d14b4249195 (patch) | |
tree | e763f0392c13c428834d20e7a8f03f15bcade932 /eqn_html.c | |
parent | d73c61d4aa397cdbeb0d0255f80bee01ee80e736 (diff) | |
download | mandoc-b1980ad8f95c0b32e91275767b1c1d14b4249195.tar.gz mandoc-b1980ad8f95c0b32e91275767b1c1d14b4249195.tar.zst mandoc-b1980ad8f95c0b32e91275767b1c1d14b4249195.zip |
When the first child of the node being validated gets deleted during
validation, man_node_unlink() switches to MAN_NEXT_CHILD. After
that, we have to switch back to MAN_NEXT_SIBLING after completing
validation, or subsequent parsing would add content into an already
closed node, clobbering potentially existing children, causing
information loss and a memory leak. Bug found by kristaps@ with
valgrind in groff(7) on Mac OS X.
Note that the switch back must be conditional, for if the node being
validated itself gets deleted, we must *not* go to MAN_NEXT_SIBLING,
which would not only yield wrong results in general but also crash
in malformed manuals having an empty paragraph before the first .SH,
for example OpenBSD c++filt(1).
Diffstat (limited to 'eqn_html.c')
0 files changed, 0 insertions, 0 deletions