Fix a bug in .Ql handling that has been present since the beginning (2017).

Since the .Ql macro action uses an output prefix of "'`" and an output
suffix of "`'", md_post_raw() would decrement the code_blocks state variable
even though md_pre_raw() had earlier neglected to increment it, hence
leaving the variable in an invalid negative state.  That in turn could
result in corrupt output in a variety of ways.

Fix this by checking in md_pre_raw() whether the prefix *contains* a
backtick rather than only checking whether it *starts* with a backtick.
For consistency, apply the same change to md_post_raw() even though
there was no bug in that function: all *suffixes* containing a backtick
actually contain it in the leading position.

Thanks to job@ for reporting this bug.  He noticed a particularly nasty
kind of output corruption: having .Ql in an input file would result
in ASCII_NBRSP (0x31) sneaking through into the output stream if later,
unrelated parts of the same input file directly or indirectly used
the \~ escape sequence, for example by using the .Ex macro.

diff --git a/usr.bin/mandoc/mdoc_markdown.c b/usr.bin/mandoc/mdoc_markdown.c
index 005a383..1c5067c 100644 (file)
--- a/usr.bin/mandoc/mdoc_markdown.c
+++ b/usr.bin/mandoc/mdoc_markdown.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: mdoc_markdown.c,v 1.36 2021/08/10 12:36:42 schwarze Exp $ */
+/* $OpenBSD: mdoc_markdown.c,v 1.37 2024/08/13 12:43:55 schwarze Exp $ */
 /*
  * Copyright (c) 2017, 2018, 2020 Ingo Schwarze <schwarze@openbsd.org>
  *
@@ -748,7 +748,7 @@ md_pre_raw(struct roff_node *n)
        if ((prefix = md_act(n->tok)->prefix) != NULL) {
                md_rawword(prefix);
                outflags &= ~MD_spc;
-               if (*prefix == '`')
+               if (strchr(prefix, '`') != NULL)
                        code_blocks++;
        }
        return 1;
@@ -762,7 +762,7 @@ md_post_raw(struct roff_node *n)
        if ((suffix = md_act(n->tok)->suffix) != NULL) {
                outflags &= ~(MD_spc | MD_nl);
                md_rawword(suffix);
-               if (*suffix == '`')
+               if (strchr(suffix, '`') != NULL)
                        code_blocks--;
        }
 }