Skip to content

Commit

Permalink
fix a NULL pointer access on empty tbl(7) data cells
Browse files Browse the repository at this point in the history 
that bentley@ found in syncthing-bep(7)
  • Loading branch information
@ischwarze
ischwarze committed Mar 18, 2019
1 parent 8694df7 commit 5f6e323
Showing 1 changed file with 5 additions and 3 deletions.
8 changes: 5 additions & 3 deletions usr.bin/mandoc/tbl_term.c
View file
@@ -1,4 +1,4 @@
/* $OpenBSD: tbl_term.c,v 1.57 2019/03/16 21:35:11 schwarze Exp $ */
/* $OpenBSD: tbl_term.c,v 1.58 2019/03/18 08:00:26 schwarze Exp $ */
/*
* Copyright (c) 2009, 2011 Kristaps Dzonsons <kristaps@bsd.lv>
* Copyright (c) 2011-2019 Ingo Schwarze <schwarze@openbsd.org>
Expand Down Expand Up @@ -627,7 +627,8 @@ tbl_hrule(struct termp *tp, const struct tbl_span *spp,

lw = cpp == NULL || cpn == NULL ||
(cpn->pos != TBL_CELL_DOWN &&
(dpn == NULL || strcmp(dpn->string, "\\^") != 0))
(dpn == NULL || dpn->string == NULL ||
strcmp(dpn->string, "\\^") != 0))
? hw : 0;
tbl_direct_border(tp, BHORIZ * lw,
col->width + col->spacing / 2);
Expand Down Expand Up @@ -673,7 +674,8 @@ tbl_hrule(struct termp *tp, const struct tbl_span *spp,

rw = cpp == NULL || cpn == NULL ||
(cpn->pos != TBL_CELL_DOWN &&
(dpn == NULL || strcmp(dpn->string, "\\^") != 0))
(dpn == NULL || dpn->string == NULL ||
strcmp(dpn->string, "\\^") != 0))
? hw : 0;

/* The line crossing at the end of this column. */
Expand Down

0 comments on commit 5f6e323

Please sign in to comment.