| Commit message (Collapse) | Author | Age | Files | Lines |
... | |
|
|
|
|
|
| |
Not exactly recommended for use, rather for groff compatibility.
While here, introduce similar SHRT_MAX limits as in man(7),
fixing a few cases of infinite output found by jsg@ with afl.
|
|
|
|
|
|
|
| |
because negative indents can get truncated, in which case we no longer
know how to restore the original indent at the end of the block.
This also solves another case of effectively infinite output found
by jsg@ with afl, triggered by very large negative indents.
|
|
|
|
|
| |
for a table cell with an "nz" layout specification,
causing essentially infinite output as found by jsg@ with afl.
|
|
|
|
|
|
|
|
|
|
|
| |
indentations or paragraph distances, large output may be generated,
which is practically the same as an endless loop; found by jsg@
with afl.
Reject such unreasonably large numbers beyond arbitrary limits
similar to those used by groff (max. 65 blank lines between paragraphs
and max. SHRT_MAX characters per output line) and fall back to
defaults when exceeded. Having the limits behave in exactly the
same way is not relevant.
|
|
|
|
| |
minus twenty lines of code in spite of enhanced functionality
|
| |
|
|
|
|
|
| |
- .sp with an invalid argument is .sp 1v, not .sp 0v
- in man(1), trailing garbage doesn't make scaling units invalid
|
| |
|
|
|
|
|
| |
Basic units, centimeters, points, ens, ems, and the rounding algorithm
were all wrong, only inches, pica, and the default vertical span worked.
|
|
|
|
|
| |
Gets rid of 25 lines of code and one static buffer.
No functional change for numbers shorter than BUFSIZ characters.
|
| |
|
|
|
|
|
|
|
| |
Similarly, avoid having the same block break two other blocks.
In some situations, this could lead to an endless loop in rew_sub()
found by jsg@ with afl.
Minimal example: .Po Ao Pc Bo Pc Ac Bc
|
|
|
|
|
|
| |
and apropos(1) mode. While here, put a space character between
options and option arguments in error messages.
Both reported by Alessandro DE LAURENZIS <just22 dot adl at gmail dot com>.
|
|
|
|
| |
patch from daniel@
|
|
|
|
|
|
|
|
| |
1) rew_sub(): Make sure REWIND_MORE is acted upon even when followed by
REWIND_NONE. This prevents .It from ending up inside other children of .Bl.
2) blk_exp_close(): Only allow extension of .Bl when it has at least
one .It. Otherwise, a broken child block could be moved in front of
the .Bl, effectively resulting in a .Bl that ended before it began.
|
| |
|
|
|
|
|
|
| |
by calling assert() when valid user input exceeds it is a bad idea.
Allocate the terminal font stack dynamically instead of crashing
above 10 entries. Issue found by jsg@ with afl.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
It accepted invalid byte sequences like 0xc080-c1bf, 0xe08080-e09fbf,
0xeda080-edbfbf, and 0xf0808080-f08fbfbf, produced valid roff Unicode
escape sequences from them, and the algorithm contained strong
defenses against any attempt to fix it.
This cures an assertion failure in the terminal formatter caused
by sneaking in ASCII 0x08 (backspace) by "encoding" it as an (invalid)
multibyte UTF-8 sequence, found by jsg@ with afl.
As a bonus, the new algorithm also reduces the code in the function
by about 20%.
|
|
|
|
| |
from jmc@
|
|
|
|
| |
Fixes an assertion found by jsg@ with afl.
|
|
|
|
|
| |
the first .It. Otherwise, move it out together with whatever
follows. Fixing an assertion failure found by jsg@ with afl.
|
|
|
|
|
|
|
|
| |
macro (for example .Xo) and never closed again, the item ends up
without a body block. This can even happen for list types that
usually don't have heads in the first place. So even in this
case, check for the existence of the body before accessing it.
NULL pointer access found by jsg@ with afl.
|
|
|
|
| |
Found by jsg@ with afl.
|
|
|
|
|
|
|
| |
already closed. In this respect, also consider lists closed
that have broken another block, their closure pending until the
end of the broken block. This avoids syntax tree corruption
leading to a NULL pointer access found by jsg@ with afl.
|
| |
|
| |
|
|
|
|
|
|
| |
as the first man(1) command line argument without -s:
Accept digits like "1", "2"; digit+letter like "3p", "1X"; and "n".
Issue reported by Svyatoslav Mishyn <juef at openmailbox dot org> (Crux Linux).
|
|
|
|
|
| |
would abort the table in an unclean way, causing assertion failures
found by jsg@.
|
|
|
|
|
| |
and change the name of \(-~ to \(|= to agree with groff;
difference found by Carsten dot Kunze at arcor dot de
|
|
|
|
|
| |
just like explicit block macros themselves.
Fixing an assertion failure jsg@ found with afl.
|
|
|
|
|
|
|
|
| |
but ends without the final delimiter, the parse point was advanced
one character too far and the invalid pointer returned to the
caller of roff_parseln(). Later use could potentially advance
the pointer even further and maybe even write to it.
Fixing a buffer overrun found by jsg@ with afl (the most severe so far).
|
|
|
|
|
|
|
| |
character of input, treat it as false, do not retry it as a string
comparison condition. This also fixes a read buffer overrun that
happened when the numerical condition advanced to the end of the
input line before erroring out, found by jsg@ with afl.
|
|
|
|
|
|
| |
When negated, they still count as false.
Found when investigating crashes jsg@ found with afl.
Not completely fixing the crashes yet.
|
|
|
|
| |
reported by Carsten dot Kunze at arcor dot de
|
|
|
|
|
| |
show the open(n) Tcl manual, as documented in man(1). Issue reported
by Svyatoslav Mishyn <juef at openmailbox dot org> (Crux Linux).
|
|
|
|
| |
patch from Jan Stary <hans at stare dot cz> some time ago.
|
| |
|
|
|
|
| |
Do not show bogus quotes when .Bl -column phrases are quoted.
|
| |
|
|
|
|
| |
Compiler warnings about unused code reported by wiz@NetBSD.
|
|
|
|
|
|
|
| |
* define MAX()
* ignore O_DIRECTORY if it isn't defined
* garbage collect two unused variables
Issues reported and fix tested by wiz@NetBSD.
|
| |
|
| |
|
| |
|
| |
|
|
|
|
| |
suggested by kristaps@
|
| |
|
| |
|
| |
|
|
|
|
| |
to help downstream distributions avoid naming conflicts.
|