Ignore unreasonably large spacing modifiers in tbl layouts.

Jan Schreiber <jes at posteo dot de> ran afl on mandoc and it turned
out mandoc tried to use spacing modifiers so large that they would
trigger assertion failures in term_ascii.c, function locale_advance().

10 files changed, 132 insertions, 5 deletions

diff --git a/mandoc.1 b/mandoc.1
index a41ae5e2..ffc291dd 100644
--- a/mandoc.1
+++ b/mandoc.1
@@ -1850,6 +1850,10 @@ The invalid character is discarded.
 A table layout specification contains an opening parenthesis,
 but no matching closing parenthesis.
 The rest of the input line, starting from the parenthesis, has no effect.
+.It Sy "ignoring excessive spacing in tbl layout"
+.Pq tbl
+A spacing modifier in a table layout is unreasonably large.
+The default spacing of 3n is used instead.
 .It Sy "tbl without any data cells"
 .Pq tbl
 A table does not contain any data cells.
diff --git a/mandoc.h b/mandoc.h
index 0cacb4b5..81941ffe 100644
--- a/mandoc.h
+++ b/mandoc.h
@@ -189,6 +189,7 @@ enum	mandocerr {
 	MANDOCERR_TBLLAYOUT_NONE, /* empty tbl layout */
 	MANDOCERR_TBLLAYOUT_CHAR, /* invalid character in tbl layout: char */
 	MANDOCERR_TBLLAYOUT_PAR, /* unmatched parenthesis in tbl layout */
+	MANDOCERR_TBLLAYOUT_SPC, /* ignoring excessive spacing in tbl layout */
 	MANDOCERR_TBLDATA_NONE, /* tbl without any data cells */
 	MANDOCERR_TBLDATA_SPAN, /* ignoring data in spanned tbl cell: data */
 	MANDOCERR_TBLDATA_EXTRA, /* ignoring extra tbl data cells: data */
diff --git a/mandoc_msg.c b/mandoc_msg.c
index 318a219e..3ec86744 100644
--- a/mandoc_msg.c
+++ b/mandoc_msg.c
@@ -190,6 +190,7 @@ static	const char *const type_message[MANDOCERR_MAX] = {
 	"empty tbl layout",
 	"invalid character in tbl layout",
 	"unmatched parenthesis in tbl layout",
+	"ignoring excessive spacing in tbl layout",
 	"tbl without any data cells",
 	"ignoring data in spanned tbl cell",
 	"ignoring extra tbl data cells",
diff --git a/regress/tbl/layout/Makefile b/regress/tbl/layout/Makefile
index 2cff5851..61fb6ad4 100644
--- a/regress/tbl/layout/Makefile
+++ b/regress/tbl/layout/Makefile
@@ -1,15 +1,17 @@
 # $OpenBSD: Makefile,v 1.6 2020/01/11 20:56:26 schwarze Exp $
 
 REGRESS_TARGETS	 = badspan center complex empty emptycol emptyline
-REGRESS_TARGETS	+= lines lines-nogroff numbers shortlines span
-LINT_TARGETS	 = badspan complex empty
+REGRESS_TARGETS	+= lines lines-nogroff numbers
+REGRESS_TARGETS	+= shortlines spacing spacing-nogroff span
+LINT_TARGETS	 = badspan complex empty spacing-nogroff
 
-# groff-1.22.3 defects:
+# groff-1.22.4 defects:
 # - When the layout is completely empty,
 #   GNU eqn produces no output whatsoever for the whole table.
 # - When there is no horizontal line at the top,
 #   vertical lines extend beyond the top of the table.
+# - Excessive spacing modifiers in the layout are honoured.
 
-SKIP_GROFF	 = empty lines-nogroff
+SKIP_GROFF	 = empty lines-nogroff spacing-nogroff
 
 .include <bsd.regress.mk>
diff --git a/regress/tbl/layout/spacing-nogroff.in b/regress/tbl/layout/spacing-nogroff.in
new file mode 100644
index 00000000..926c975f
--- /dev/null
+++ b/regress/tbl/layout/spacing-nogroff.in
@@ -0,0 +1,13 @@
+.\" $OpenBSD$
+.TH TBL-LAYOUT-SPACING 1 "September 1, 2020"
+.SH NAME
+tbl-layout-spacing-nogroff \- excessive spacing modifier
+.SH DESCRIPTION
+initial text
+.TS
+box tab(:);
+R 10 L.
+a:b
+.TE
+.sp
+final text
diff --git a/regress/tbl/layout/spacing-nogroff.out_ascii b/regress/tbl/layout/spacing-nogroff.out_ascii
new file mode 100644
index 00000000..f4d68e74
--- /dev/null
+++ b/regress/tbl/layout/spacing-nogroff.out_ascii
@@ -0,0 +1,18 @@
+TBL-LAYOUT-SPACING(1)       General Commands Manual      TBL-LAYOUT-SPACING(1)
+
+
+
+NNAAMMEE
+       tbl-layout-spacing-nogroff - excessive spacing modifier
+
+DDEESSCCRRIIPPTTIIOONN
+       initial text
+
+       +------+
+       |a   b |
+       +------+
+       final text
+
+
+
+OpenBSD                        September 1, 2020         TBL-LAYOUT-SPACING(1)
diff --git a/regress/tbl/layout/spacing-nogroff.out_lint b/regress/tbl/layout/spacing-nogroff.out_lint
new file mode 100644
index 00000000..6f659c21
--- /dev/null
+++ b/regress/tbl/layout/spacing-nogroff.out_lint
@@ -0,0 +1 @@
+mandoc: spacing-nogroff.in:9:3: ERROR: ignoring excessive spacing in tbl layout: 10
diff --git a/regress/tbl/layout/spacing.in b/regress/tbl/layout/spacing.in
new file mode 100644
index 00000000..228334b7
--- /dev/null
+++ b/regress/tbl/layout/spacing.in
@@ -0,0 +1,43 @@
+.\" $OpenBSD$
+.TH TBL-LAYOUT-SPACING 1 "September 1, 2020"
+.SH NAME
+tbl-layout-spacing \- spacing modifiers
+.SH DESCRIPTION
+default spacing:
+.TS
+box tab(:);
+R L.
+a:b
+.TE
+.sp
+spacing 0:
+.TS
+box tab(:);
+R 0 L.
+a:b
+.TE
+.sp
+spacing 1:
+.TS
+box tab(:);
+R 1 L.
+a:b
+.TE
+.sp
+spacing 2:
+.TS
+allbox tab(:);
+R 2 L.
+a:b
+.TE
+.sp
+spacing 5:
+.TS
+allbox tab(:);
+R 5|| L.
+a:b
+.TE
+.sp
+leaked tab settings:
+.br
+a	b	c	d	e	f
diff --git a/regress/tbl/layout/spacing.out_ascii b/regress/tbl/layout/spacing.out_ascii
new file mode 100644
index 00000000..3d51d7d5
--- /dev/null
+++ b/regress/tbl/layout/spacing.out_ascii
@@ -0,0 +1,39 @@
+TBL-LAYOUT-SPACING(1)       General Commands Manual      TBL-LAYOUT-SPACING(1)
+
+
+
+NNAAMMEE
+       tbl-layout-spacing - spacing modifiers
+
+DDEESSCCRRIIPPTTIIOONN
+       default spacing:
+
+       +------+
+       |a   b |
+       +------+
+       spacing 0:
+
+       +---+
+       |ab |
+       +---+
+       spacing 1:
+
+       +----+
+       |a b |
+       +----+
+       spacing 2:
+
+       +--+--+
+       |a |b |
+       +--+--+
+       spacing 5:
+
+       +---++---+
+       |a  || b |
+       +---++---+
+       leaked tab settings:
+       a b     cdef
+
+
+
+OpenBSD                        September 1, 2020         TBL-LAYOUT-SPACING(1)
diff --git a/tbl_layout.c b/tbl_layout.c
index cd57cf95..34952e06 100644
--- a/tbl_layout.c
+++ b/tbl_layout.c
@@ -65,6 +65,7 @@ mods(struct tbl_node *tbl, struct tbl_cell *cp,
 		int ln, const char *p, int *pos)
 {
 	char		*endptr;
+	unsigned long	 spacing;
 	size_t		 sz;
 
 mod:
@@ -93,7 +94,11 @@ mod:
 	/* Parse numerical spacing from modifier string. */
 
 	if (isdigit((unsigned char)p[*pos])) {
-		cp->spacing = strtoull(p + *pos, &endptr, 10);
+		if ((spacing = strtoul(p + *pos, &endptr, 10)) > 9)
+			mandoc_msg(MANDOCERR_TBLLAYOUT_SPC, ln, *pos,
+			    "%lu", spacing);
+		else
+			cp->spacing = spacing;
 		*pos = endptr - p;
 		goto mod;
 	}