When we open a new .while loop, let's not attempt to close out

another enclosing .while loop at the same time.
Instead, postpone the closing until the next iteration of ROFF_RERUN.

This prevents one-line constructions like ".while 0 .while 0 something"
and ".while rx .while rx .rr x" (which admittedly aren't particularly
useful) from dying of abort(3), which was a bug tb@ found with afl(1).

1 files changed, 4 insertions, 2 deletions

diff --git a/roff.c b/roff.c
index 17aacf66..f2644602 100644
--- a/roff.c
+++ b/roff.c
@@ -2433,9 +2433,11 @@ roff_cond_sub(ROFF_ARGS)
 			}
 		}
 	} else if (t != TOKEN_NONE &&
-	    (rr || roffs[t].flags & ROFFMAC_STRUCT))
+	    (rr || roffs[t].flags & ROFFMAC_STRUCT)) {
 		irc |= (*roffs[t].proc)(r, t, buf, ln, ppos, pos, offs);
-	else
+		if (irc & ROFF_WHILE)
+			irc &= ~(ROFF_LOOPCONT | ROFF_LOOPEXIT);
+	} else
 		irc |= rr ? ROFF_CONT : ROFF_IGN;
 	return irc;
 }