CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/09/10 10:16:11
Modified files:
usr.bin/mandoc : mdoc_validate.c
Log message:
Fix a logic error in post_bl() that could cause a NULL pointer access.
When a column list does not use explicit .It macros and contains
at least one text line followed by a node generated on the roff(7)
level, for example an eqn(7) node, and then nothing more, in
particular no following .It macro, the code wraps the node generated
on the roff level in an implicit .It macro. After moving the node
into the new .It macro, the loop variable "nchild" iterating over
the children of .Bl must be set to NULL to exit the while loop.
Instead, the loop variable remained pointing at the moved node, and
the loop tried to move it again, resulting in an access to its
"prev" pointer, which is of course NULL in this situation.
Hippolyte Doncieu de la Batie <[email protected]>
found this bug using clang-14 with libFuzzer
and drafted an almost correct patch to fix it.
The first half of his patch was correct;
i slightly rearranged it with no functional change
to make the code two lines shorter and easier to read.
The second half of his patch is neither needed nor correct,
so i simply dropped that part.
Reported via espie@.
