From: schwarze <schwarze@openbsd.org>
Date: Tue, 13 Aug 2024 12:43:55 +0000 (+0000)
Subject: Fix a bug in .Ql handling that has been present since the beginning (2017).
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=0272cb5caf6c1add79ccc0b56bfd872c379e9fb2;p=openbsd

Fix a bug in .Ql handling that has been present since the beginning (2017).

Since the .Ql macro action uses an output prefix of "'`" and an output
suffix of "`'", md_post_raw() would decrement the code_blocks state variable
even though md_pre_raw() had earlier neglected to increment it, hence
leaving the variable in an invalid negative state.  That in turn could
result in corrupt output in a variety of ways.

Fix this by checking in md_pre_raw() whether the prefix *contains* a
backtick rather than only checking whether it *starts* with a backtick.
For consistency, apply the same change to md_post_raw() even though
there was no bug in that function: all *suffixes* containing a backtick
actually contain it in the leading position.

Thanks to job@ for reporting this bug.  He noticed a particularly nasty
kind of output corruption: having .Ql in an input file would result
in ASCII_NBRSP (0x31) sneaking through into the output stream if later,
unrelated parts of the same input file directly or indirectly used
the \~ escape sequence, for example by using the .Ex macro.
---

diff --git a/usr.bin/mandoc/mdoc_markdown.c b/usr.bin/mandoc/mdoc_markdown.c
index 005a38315cb..1c5067cbcfc 100644
--- a/usr.bin/mandoc/mdoc_markdown.c
+++ b/usr.bin/mandoc/mdoc_markdown.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: mdoc_markdown.c,v 1.36 2021/08/10 12:36:42 schwarze Exp $ */
+/* $OpenBSD: mdoc_markdown.c,v 1.37 2024/08/13 12:43:55 schwarze Exp $ */
 /*
  * Copyright (c) 2017, 2018, 2020 Ingo Schwarze <schwarze@openbsd.org>
  *
@@ -748,7 +748,7 @@ md_pre_raw(struct roff_node *n)
 	if ((prefix = md_act(n->tok)->prefix) != NULL) {
 		md_rawword(prefix);
 		outflags &= ~MD_spc;
-		if (*prefix == '`')
+		if (strchr(prefix, '`') != NULL)
 			code_blocks++;
 	}
 	return 1;
@@ -762,7 +762,7 @@ md_post_raw(struct roff_node *n)
 	if ((suffix = md_act(n->tok)->suffix) != NULL) {
 		outflags &= ~(MD_spc | MD_nl);
 		md_rawword(suffix);
-		if (*suffix == '`')
+		if (strchr(suffix, '`') != NULL)
 			code_blocks--;
 	}
 }