Improve detection of recursive eqn(7) "define" statements:

Do not only catch "define key 'key other stuff'",
but also "define key 'other stuff key'".
Fixing infinite loop found by tb@ with afl(1).

1 files changed, 7 insertions, 2 deletions

diff --git a/eqn.c b/eqn.c
index 2d979dcd..e3b31e98 100644
--- a/eqn.c
+++ b/eqn.c
@@ -366,15 +366,19 @@ eqn_def_find(struct eqn_node *ep, const char *key, size_t sz)
 static const char *
 eqn_next(struct eqn_node *ep, char quote, size_t *sz, int repl)
 {
+	static size_t	 last_len;
+	static int	 lim;
+
 	char		*start, *next;
-	int		 q, diff, lim;
+	int		 q, diff;
 	size_t		 ssz, dummy;
 	struct eqn_def	*def;
 
 	if (NULL == sz)
 		sz = &dummy;
 
-	lim = 0;
+	if (ep->cur >= last_len)
+		lim = 0;
 	ep->rew = ep->cur;
 again:
 	/* Prevent self-definitions. */
@@ -448,6 +452,7 @@ again:
 		memmove(start + *sz + diff, start + *sz,
 		    (strlen(start) - *sz) + 1);
 		memcpy(start, def->val, def->valsz);
+		last_len = start - ep->data + def->valsz;
 		lim++;
 		goto again;
 	}