From a6c2450037bcdf0d5324b4259a03eec8b4a2645c Mon Sep 17 00:00:00 2001 From: Ingo Schwarze Date: Tue, 21 Apr 2015 16:14:25 +0000 Subject: Avoid a use after free when the target node is deleted during validation. Bug reported by jsg@. --- mdoc_macro.c | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/mdoc_macro.c b/mdoc_macro.c index 8322cca5..8a811652 100644 --- a/mdoc_macro.c +++ b/mdoc_macro.c @@ -1,4 +1,4 @@ -/* $Id: mdoc_macro.c,v 1.193 2015/04/19 14:57:38 schwarze Exp $ */ +/* $Id: mdoc_macro.c,v 1.194 2015/04/21 16:14:25 schwarze Exp $ */ /* * Copyright (c) 2008-2012 Kristaps Dzonsons * Copyright (c) 2010, 2012-2015 Ingo Schwarze @@ -291,18 +291,21 @@ rew_pending(struct roff_man *mdoc, const struct roff_node *n) for (;;) { rew_last(mdoc, n); - switch (n->type) { - case ROFFT_HEAD: - roff_body_alloc(mdoc, n->line, n->pos, n->tok); - return; - case ROFFT_BLOCK: - break; - default: - return; - } - - if ( ! (n->flags & MDOC_BROKEN)) - return; + if (mdoc->last == n) { + switch (n->type) { + case ROFFT_HEAD: + roff_body_alloc(mdoc, n->line, n->pos, + n->tok); + return; + case ROFFT_BLOCK: + break; + default: + return; + } + if ( ! (n->flags & MDOC_BROKEN)) + return; + } else + n = mdoc->last; for (;;) { if ((n = n->parent) == NULL) -- cgit v1.2.3-56-ge451