From 7514a273fe4561e94f1277f4ee5991c9af9cba2e Mon Sep 17 00:00:00 2001
From: schwarze <schwarze@openbsd.org>
Date: Tue, 11 Jun 2019 15:40:41 +0000
Subject: [PATCH] Do not access a NULL pointer if a table contains a horizontal
 line next to a table line having fewer columns than the table as a whole. Bug
 found by Stephen Gregoratto <dev at sgregoratto dot me> with aerc-config(5).

---
 regress/usr.bin/mandoc/tbl/layout/Makefile    |  4 +-
 .../usr.bin/mandoc/tbl/layout/shortlines.in   | 49 +++++++++++++++++++
 .../mandoc/tbl/layout/shortlines.out_ascii    | 48 ++++++++++++++++++
 usr.bin/mandoc/tbl_term.c                     | 16 ++++--
 4 files changed, 110 insertions(+), 7 deletions(-)
 create mode 100644 regress/usr.bin/mandoc/tbl/layout/shortlines.in
 create mode 100644 regress/usr.bin/mandoc/tbl/layout/shortlines.out_ascii

diff --git a/regress/usr.bin/mandoc/tbl/layout/Makefile b/regress/usr.bin/mandoc/tbl/layout/Makefile
index 7b1ab714bead..a56cbc2fcd86 100644
--- a/regress/usr.bin/mandoc/tbl/layout/Makefile
+++ b/regress/usr.bin/mandoc/tbl/layout/Makefile
@@ -1,7 +1,7 @@
-# $OpenBSD: Makefile,v 1.3 2017/06/16 20:00:41 schwarze Exp $
+# $OpenBSD: Makefile,v 1.4 2019/06/11 15:40:41 schwarze Exp $
 
 REGRESS_TARGETS	 = center complex empty emptyline
-REGRESS_TARGETS	+= lines lines-nogroff numbers span
+REGRESS_TARGETS	+= lines lines-nogroff numbers shortlines span
 LINT_TARGETS	 = complex empty
 
 # groff-1.22.3 defects:
diff --git a/regress/usr.bin/mandoc/tbl/layout/shortlines.in b/regress/usr.bin/mandoc/tbl/layout/shortlines.in
new file mode 100644
index 000000000000..f64346194429
--- /dev/null
+++ b/regress/usr.bin/mandoc/tbl/layout/shortlines.in
@@ -0,0 +1,49 @@
+.\" $OpenBSD: shortlines.in,v 1.1 2019/06/11 15:40:41 schwarze Exp $
+.TH TBL-LAYOUT-SHORTLINES 1 "June 11, 2019"
+.SH NAME
+tbl-layout-shortlines \- table lines of different length
+.SH DESCRIPTION
+normal text
+.TS
+allbox tab(:);
+L L
+L
+L L.
+left:right
+short
+left:right
+.TE
+.sp
+.TS
+allbox tab(:);
+L L
+L
+L
+L L.
+left:right
+first short
+second short
+left:right
+.TE
+.sp
+.TS
+allbox tab(:);
+L L L
+L L
+L.
+left:middle:right
+short:line
+very short
+.TE
+.sp
+.TS
+allbox tab(:);
+L
+L L
+L L L.
+very short
+short:line
+left:middle:right
+.TE
+
+
diff --git a/regress/usr.bin/mandoc/tbl/layout/shortlines.out_ascii b/regress/usr.bin/mandoc/tbl/layout/shortlines.out_ascii
new file mode 100644
index 000000000000..02fe01d78225
--- /dev/null
+++ b/regress/usr.bin/mandoc/tbl/layout/shortlines.out_ascii
@@ -0,0 +1,48 @@
+TBL-LAYOUT-SHORTLINES(1)    General Commands Manual   TBL-LAYOUT-SHORTLINES(1)
+
+
+
+NNAAMMEE
+       tbl-layout-shortlines - table lines of different length
+
+DDEESSCCRRIIPPTTIIOONN
+       normal text
+
+       +------+-------+
+       |left  | right |
+       +------+-------+
+       |short |       |
+       +------+-------+
+       |left  | right |
+       +------+-------+
+
+       +-------------+-------+
+       |left         | right |
+       +-------------+-------+
+       |first short  |       |
+       +-------------+-------+
+       |second short |       |
+       +-------------+-------+
+       |left         | right |
+       +-------------+-------+
+
+       +-----------+--------+-------+
+       |left       | middle | right |
+       +-----------+--------+-------+
+       |short      | line   |       |
+       +-----------+--------+-------+
+       |very short |        |       |
+       +-----------+--------+-------+
+
+       +-----------+--------+-------+
+       |very short |        |       |
+       +-----------+--------+-------+
+       |short      | line   |       |
+       +-----------+--------+-------+
+       |left       | middle | right |
+       +-----------+--------+-------+
+
+
+
+
+OpenBSD                          June 11, 2019        TBL-LAYOUT-SHORTLINES(1)
diff --git a/usr.bin/mandoc/tbl_term.c b/usr.bin/mandoc/tbl_term.c
index c8af6165b5cf..f3e47ad8ed10 100644
--- a/usr.bin/mandoc/tbl_term.c
+++ b/usr.bin/mandoc/tbl_term.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tbl_term.c,v 1.58 2019/03/18 08:00:26 schwarze Exp $ */
+/*	$OpenBSD: tbl_term.c,v 1.59 2019/06/11 15:40:41 schwarze Exp $ */
 /*
  * Copyright (c) 2009, 2011 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2011-2019 Ingo Schwarze <schwarze@openbsd.org>
@@ -620,8 +620,12 @@ tbl_hrule(struct termp *tp, const struct tbl_span *spp,
 		    (spp == NULL || cpn == NULL ||
 		     cpn->pos != TBL_CELL_DOWN ? BRIGHT * hw : 0), 1);
 
+	col = tp->tbl.cols;
 	for (;;) {
-		col = tp->tbl.cols + cp->col;
+		if (cp == NULL)
+			col++;
+		else
+			col = tp->tbl.cols + cp->col;
 
 		/* Print the horizontal line inside this column. */
 
@@ -647,7 +651,8 @@ tbl_hrule(struct termp *tp, const struct tbl_span *spp,
 					uw = 1;
 			}
 			cpp = cpp->next;
-		}
+		} else if (spp != NULL && opts & TBL_OPT_ALLBOX)
+			uw = 1;
 		if (cp != NULL)
 			cp = cp->next;
 		if (cpn != NULL) {
@@ -659,8 +664,9 @@ tbl_hrule(struct termp *tp, const struct tbl_span *spp,
 			cpn = cpn->next;
 			while (dpn != NULL && dpn->layout != cpn)
 				dpn = dpn->next;
-		}
-		if (cpp == NULL && cp == NULL && cpn == NULL)
+		} else if (spn != NULL && opts & TBL_OPT_ALLBOX)
+			dw = 1;
+		if (col + 1 == tp->tbl.cols + sp->opts->cols)
 			break;
 
 		/* Vertical lines do not cross spanned cells. */