From bbc2a36ee2ac85ca438a009fda76b29d2bf869d8 Mon Sep 17 00:00:00 2001
From: Ingo Schwarze <schwarze@openbsd.org>
Date: Thu, 20 Nov 2014 13:56:20 +0000
Subject: Prevent negative arguments to the .ll request from causing integer
 underflow.  Found while preparing an audit of termp.rmargin.

Overflow can also happen, but i see no sane way to deal with it,
so just let it happen.  It doesn't happen for any sane input anyway,
groff behaviour is undefined, and the resulting values are legal,
even though they are useless.
---
 term_ascii.c | 8 +++++---
 term_ps.c    | 8 +++++---
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/term_ascii.c b/term_ascii.c
index 9b5921ff..94be3597 100644
--- a/term_ascii.c
+++ b/term_ascii.c
@@ -159,12 +159,14 @@ ascii_setwidth(struct termp *p, int iop, size_t width)
 {
 
 	p->rmargin = p->defrmargin;
-	if (0 < iop)
+	if (iop > 0)
 		p->defrmargin += width;
-	else if (0 > iop)
+	else if (iop == 0)
+		p->defrmargin = width ? width : p->lastrmargin;
+	else if (p->defrmargin > width)
 		p->defrmargin -= width;
 	else
-		p->defrmargin = width ? width : p->lastrmargin;
+		p->defrmargin = 0;
 	p->lastrmargin = p->rmargin;
 	p->rmargin = p->maxrmargin = p->defrmargin;
 }
diff --git a/term_ps.c b/term_ps.c
index f1129c2d..344db82f 100644
--- a/term_ps.c
+++ b/term_ps.c
@@ -635,12 +635,14 @@ ps_setwidth(struct termp *p, int iop, size_t width)
 	size_t	 lastwidth;
 
 	lastwidth = p->ps->width;
-	if (0 < iop)
+	if (iop > 0)
 		p->ps->width += width;
-	else if (0 > iop)
+	else if (iop == 0)
+		p->ps->width = width ? width : p->ps->lastwidth;
+	else if (p->ps->width > width)
 		p->ps->width -= width;
 	else
-		p->ps->width = width ? width : p->ps->lastwidth;
+		p->ps->width = 0;
 	p->ps->lastwidth = lastwidth;
 }
 
-- 
cgit