We repeatedly observed assertion crashes in the low-level terminal

output handler because the high level terminal formatters could be
tricked into setting the left margin further to the right than the
right margin.  Today, jsg@ found more of these with afl.

Change the internal interface between both levels, aiming for
simplicity and robustness of the code.  Treat both margins as
*independent* settings:  Now, termp.offset is the requested left
margin, and termp.rmargin is the available space.  Let the lower
level cope with that case of insufficient space.

Obviously, high level code that does centering or flush right
still has to do careful checks, so i did a full audit of margin
settings in the terminal formatters.

Fixes crashes caused by excessively long title or date strings in
the man(7) footer, operating system or date strings in the mdoc(7)
footer, volume strings in the man(7) or mdoc(7) header, and a few
cases related to some non-prologue macros.

1 files changed, 8 insertions, 10 deletions

diff --git a/mdoc_term.c b/mdoc_term.c
index d5298d9a..8f440733 100644
--- a/mdoc_term.c
+++ b/mdoc_term.c
@@ -405,6 +405,7 @@ static void
 print_mdoc_foot(struct termp *p, const void *arg)
 {
 	const struct mdoc_meta *meta;
+	size_t sz;
 
 	meta = (const struct mdoc_meta *)arg;
 
@@ -421,8 +422,9 @@ print_mdoc_foot(struct termp *p, const void *arg)
 	term_vspace(p);
 
 	p->offset = 0;
-	p->rmargin = (p->maxrmargin -
-	    term_strlen(p, meta->date) + term_len(p, 1)) / 2;
+	sz = term_strlen(p, meta->date);
+	p->rmargin = p->maxrmargin > sz ?
+	    (p->maxrmargin + term_len(p, 1) - sz) / 2 : 0;
 	p->trailspace = 1;
 	p->flags |= TERMP_NOSPACE | TERMP_NOBREAK;
 
@@ -430,7 +432,8 @@ print_mdoc_foot(struct termp *p, const void *arg)
 	term_flushln(p);
 
 	p->offset = p->rmargin;
-	p->rmargin = p->maxrmargin - term_strlen(p, meta->os);
+	sz = term_strlen(p, meta->os);
+	p->rmargin = p->maxrmargin > sz ? p->maxrmargin - sz : 0;
 	p->flags |= TERMP_NOSPACE;
 
 	term_word(p, meta->date);
@@ -492,7 +495,7 @@ print_mdoc_head(struct termp *p, const void *arg)
 	p->offset = 0;
 	p->rmargin = 2 * (titlen+1) + vollen < p->maxrmargin ?
 	    (p->maxrmargin - vollen + term_len(p, 1)) / 2 :
-	    p->maxrmargin - vollen;
+	    vollen < p->maxrmargin ?  p->maxrmargin - vollen : 0;
 
 	term_word(p, title);
 	term_flushln(p);
@@ -873,11 +876,8 @@ termp_it_pre(DECL_ARGS)
 		assert(width);
 		if (MDOC_HEAD == n->type)
 			p->rmargin = p->offset + width;
-		else {
+		else
 			p->offset += width;
-			if (p->rmargin < p->offset)
-				p->rmargin = p->offset;
-		}
 		break;
 	case LIST_column:
 		assert(width);
@@ -1010,8 +1010,6 @@ termp_nm_pre(DECL_ARGS)
 		     MDOC_TEXT == n->prev->child->type ?
 		     term_strlen(p, n->prev->child->string) :
 		     term_len(p, 5));
-		if (p->rmargin < p->offset)
-			p->rmargin = p->offset;
 		return(1);
 	}