diff options
| author | Ingo Schwarze <schwarze@openbsd.org> | 2015-01-01 15:36:08 +0000 |
|---|---|---|
| committer | Ingo Schwarze <schwarze@openbsd.org> | 2015-01-01 15:36:08 +0000 |
| commit | ef53727c250e97b0412d4f51253d6e017464507f (patch) | |
| tree | d2d754460ee44ca69f8a814eb0acb9e910846158 /eqn_term.c | |
| parent | 78a4b29f991e8b77a145ee53064c23efc539dd5d (diff) | |
| download | mandoc-ef53727c250e97b0412d4f51253d6e017464507f.tar.gz | |
Don't dereference NULL pointers when formatting missing denominators,
subscripts, superscripts, or "from" or "to" arguments.
Found by jsg@ with afl.
Diffstat (limited to 'eqn_term.c')
| -rw-r--r-- | eqn_term.c | 19 |
1 files changed, 11 insertions, 8 deletions
@@ -1,7 +1,7 @@ /* $Id$ */ /* * Copyright (c) 2011 Kristaps Dzonsons <kristaps@bsd.lv> - * Copyright (c) 2014 Ingo Schwarze <schwarze@openbsd.org> + * Copyright (c) 2014, 2015 Ingo Schwarze <schwarze@openbsd.org> * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -79,14 +79,17 @@ eqn_box(struct termp *p, const struct eqn_box *bp) bp->pos == EQNPOS_TO) ? "^" : "_"); p->flags |= TERMP_NOSPACE; child = child->next; - eqn_box(p, child); - if (bp->pos == EQNPOS_FROMTO || - bp->pos == EQNPOS_SUBSUP) { - p->flags |= TERMP_NOSPACE; - term_word(p, "^"); - p->flags |= TERMP_NOSPACE; - child = child->next; + if (child != NULL) { eqn_box(p, child); + if (bp->pos == EQNPOS_FROMTO || + bp->pos == EQNPOS_SUBSUP) { + p->flags |= TERMP_NOSPACE; + term_word(p, "^"); + p->flags |= TERMP_NOSPACE; + child = child->next; + if (child != NULL) + eqn_box(p, child); + } } } else { child = bp->first; |