From 4739b39372b31b9276373673e199b90e33fb70a8 Mon Sep 17 00:00:00 2001 From: Ingo Schwarze Date: Thu, 28 Apr 2022 10:26:37 +0000 Subject: Element next-line scopes may nest, so man_breakscope() may have to break multiple element next-line scopes at the same time, similar to what man_descope() already does for unconditional rewinding. This fixes an assertion failure that tb@ found with afl(1), caused by .SH .I .I .BI and similar sequences of macros without arguments. --- man.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) (limited to 'man.c') diff --git a/man.c b/man.c index f0e4002b..8c592b70 100644 --- a/man.c +++ b/man.c @@ -1,7 +1,7 @@ -/* $Id: man.c,v 1.187 2019/01/05 00:36:50 schwarze Exp $ */ +/* $Id: man.c,v 1.188 2022/04/28 10:26:37 schwarze Exp $ */ /* + * Copyright (c) 2013-2015,2017-2019,2022 Ingo Schwarze * Copyright (c) 2008, 2009, 2010, 2011 Kristaps Dzonsons - * Copyright (c) 2013-2015, 2017-2019 Ingo Schwarze * Copyright (c) 2011 Joerg Sonnenberger * * Permission to use, copy, modify, and distribute this software for any @@ -70,6 +70,9 @@ man_hasc(char *start) return (ep - cp) % 2 ? NULL : ep; } +/* + * Rewind all open next-line scopes. + */ void man_descope(struct roff_man *man, int line, int offs, char *start) { @@ -274,6 +277,10 @@ man_pmacro(struct roff_man *man, int ln, char *buf, int offs) return 1; } +/* + * Rewind open next-line scopes + * unless the tok request or macro is allowed inside them. + */ void man_breakscope(struct roff_man *man, int tok) { @@ -294,10 +301,15 @@ man_breakscope(struct roff_man *man, int tok) (man_macro(n->tok)->flags & (MAN_NSCOPED | MAN_ESCOPED)) == MAN_NSCOPED) n = n->parent; - - mandoc_msg(MANDOCERR_BLK_LINE, n->line, n->pos, - "%s breaks %s", roff_name[tok], roff_name[n->tok]); - + for (;;) { + mandoc_msg(MANDOCERR_BLK_LINE, n->line, n->pos, + "%s breaks %s", roff_name[tok], roff_name[n->tok]); + if (n->parent->type != ROFFT_ELEM || + (man_macro(n->parent->tok)->flags & + MAN_ESCOPED) == 0) + break; + n = n->parent; + } roff_node_delete(man, n); man->flags &= ~MAN_ELINE; } -- cgit v1.2.3-56-ge451