From: schwarze Date: Wed, 13 Apr 2022 20:19:18 +0000 (+0000) Subject: To prevent infinite recursion while expanding eqn(7) definitions, X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=5030fd5bc503d5c97990cc21fbabbb13126c40e8;p=openbsd To prevent infinite recursion while expanding eqn(7) definitions, we must not reset the recursion counter when moving beyond the end of the *previous* expansion, but we may only do so when moving beyond the rightmost position reached by *any* expansion in the current equation. This matters because definitions can nest; consider: .EQ define inner "content" define outer "inner outer" outer .EN This endless loop was found by tb@ using afl(1). Incidentally, GNU eqn(1) also performs an infinite loop in this situation and then crashes when memory runs out, but that's not an excuse for nasty behaviour of mandoc(1). While here, consistently print the expanded content even when the expansion is finally truncated. While that is not likely to help end-users, it may help authors of eqn(7) code to understand what's going on. Besides, it sends a very clear signal that something is amiss, which was easy to miss in the past unless people enabled -W error or used -T lint. --- diff --git a/regress/usr.bin/mandoc/eqn/define/infinite.in b/regress/usr.bin/mandoc/eqn/define/infinite.in index 420e63766b9..31a3f646a75 100644 --- a/regress/usr.bin/mandoc/eqn/define/infinite.in +++ b/regress/usr.bin/mandoc/eqn/define/infinite.in @@ -1,5 +1,5 @@ -.\" $OpenBSD: infinite.in,v 1.2 2017/07/04 14:53:23 schwarze Exp $ -.Dd $Mdocdate: July 4 2017 $ +.\" $OpenBSD: infinite.in,v 1.3 2022/04/13 20:19:18 schwarze Exp $ +.Dd $Mdocdate: April 13 2022 $ .Dt DEFINE-INFINITE 1 .Os .Sh NAME @@ -29,3 +29,11 @@ trailing position: define key 'prefix key' key .EN eol +.Pp +nested expansion: +.EQ +define inner "content" +define outer "inner outer" +outer +.EN +eol diff --git a/regress/usr.bin/mandoc/eqn/define/infinite.out_ascii b/regress/usr.bin/mandoc/eqn/define/infinite.out_ascii index 7219ce5b336..a756abbb70b 100644 --- a/regress/usr.bin/mandoc/eqn/define/infinite.out_ascii +++ b/regress/usr.bin/mandoc/eqn/define/infinite.out_ascii @@ -4,12 +4,72 @@ NNAAMMEE ddeeffiinnee--iinnffiinniittee - infinite recursion in define statements DDEESSCCRRIIPPTTIIOONN - alone: eol + alone: _k_e_y eol - leading position: eol + leading position: _k_e_y _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x eol - middle position: eol + middle position: _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _k_e_y + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x + _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x _s_u_f_f_i_x eol - trailing position: eol + trailing position: _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x _p_r_e_f_i_x + _p_r_e_f_i_x _k_e_y eol -OpenBSD July 4, 2017 OpenBSD + nested expansion: _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t + _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t + _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t + _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t + _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t + _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t + _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t + _c_o_n_t_e_n_t _c_o_n_t_e_n_t _c_o_n_t_e_n_t _o_u_t_e_r eol + +OpenBSD April 13, 2022 OpenBSD diff --git a/regress/usr.bin/mandoc/eqn/define/infinite.out_lint b/regress/usr.bin/mandoc/eqn/define/infinite.out_lint index 43089bb3be5..245aa523fb2 100644 --- a/regress/usr.bin/mandoc/eqn/define/infinite.out_lint +++ b/regress/usr.bin/mandoc/eqn/define/infinite.out_lint @@ -2,3 +2,4 @@ mandoc: infinite.in:10:2: ERROR: input stack limit exceeded, infinite loop? mandoc: infinite.in:16:2: ERROR: input stack limit exceeded, infinite loop? mandoc: infinite.in:22:2: ERROR: input stack limit exceeded, infinite loop? mandoc: infinite.in:28:2: ERROR: input stack limit exceeded, infinite loop? +mandoc: infinite.in:34:2: ERROR: input stack limit exceeded, infinite loop? diff --git a/usr.bin/mandoc/eqn.c b/usr.bin/mandoc/eqn.c index ad3206770bb..51e7bdd55e6 100644 --- a/usr.bin/mandoc/eqn.c +++ b/usr.bin/mandoc/eqn.c @@ -1,7 +1,8 @@ -/* $OpenBSD: eqn.c,v 1.47 2020/01/08 12:09:14 schwarze Exp $ */ +/* $OpenBSD: eqn.c,v 1.48 2022/04/13 20:19:18 schwarze Exp $ */ /* + * Copyright (c) 2014, 2015, 2017, 2018, 2020, 2022 + * Ingo Schwarze * Copyright (c) 2011, 2014 Kristaps Dzonsons - * Copyright (c) 2014,2015,2017,2018,2020 Ingo Schwarze * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -373,19 +374,17 @@ eqn_def_find(struct eqn_node *ep) static enum eqn_tok eqn_next(struct eqn_node *ep, enum parse_mode mode) { - static int last_len, lim; - struct eqn_def *def; size_t start; - int diff, i, quoted; + int diff, i, newlen, quoted; enum eqn_tok tok; /* * Reset the recursion counter after advancing - * beyond the end of the previous substitution. + * beyond the end of the rightmost substitution. */ - if (ep->end - ep->data >= last_len) - lim = 0; + if (ep->end - ep->data >= ep->sublen) + ep->subcnt = 0; ep->start = ep->end; quoted = mode == MODE_QUOTED; @@ -432,10 +431,10 @@ eqn_next(struct eqn_node *ep, enum parse_mode mode) return EQN_TOK__MAX; if ((def = eqn_def_find(ep)) == NULL) break; - if (++lim > EQN_NEST_MAX) { + if (++ep->subcnt > EQN_NEST_MAX) { mandoc_msg(MANDOCERR_ROFFLOOP, ep->node->line, ep->node->pos, NULL); - return EQN_TOK_EOF; + break; } /* Replace a defined name with its string value. */ @@ -444,12 +443,15 @@ eqn_next(struct eqn_node *ep, enum parse_mode mode) ep->sz += diff; ep->data = mandoc_realloc(ep->data, ep->sz + 1); ep->start = ep->data + start; + ep->sublen += diff; } if (diff) memmove(ep->start + def->valsz, ep->start + ep->toksz, strlen(ep->start + ep->toksz) + 1); memcpy(ep->start, def->val, def->valsz); - last_len = ep->start - ep->data + def->valsz; + newlen = ep->start - ep->data + def->valsz; + if (ep->sublen < newlen) + ep->sublen = newlen; } if (mode != MODE_TOK) return quoted ? EQN_TOK_QUOTED : EQN_TOK__MAX; @@ -676,6 +678,8 @@ eqn_parse(struct eqn_node *ep) return; ep->start = ep->end = ep->data; + ep->sublen = 0; + ep->subcnt = 0; next_tok: tok = eqn_next(ep, MODE_TOK); diff --git a/usr.bin/mandoc/eqn_parse.h b/usr.bin/mandoc/eqn_parse.h index 0a8e61953b9..2033b5445b6 100644 --- a/usr.bin/mandoc/eqn_parse.h +++ b/usr.bin/mandoc/eqn_parse.h @@ -1,7 +1,7 @@ -/* $OpenBSD: eqn_parse.h,v 1.3 2018/12/14 06:33:03 schwarze Exp $ */ +/* $OpenBSD: eqn_parse.h,v 1.4 2022/04/13 20:19:18 schwarze Exp $ */ /* + * Copyright (c) 2014, 2017, 2018, 2022 Ingo Schwarze * Copyright (c) 2011 Kristaps Dzonsons - * Copyright (c) 2014, 2017, 2018 Ingo Schwarze * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -32,6 +32,8 @@ struct eqn_node { size_t defsz; /* Number of definitions. */ size_t sz; /* Length of the source code. */ size_t toksz; /* Length of the current token. */ + int sublen; /* End of rightmost substitution, so far. */ + int subcnt; /* Number of recursive substitutions. */ int gsize; /* Default point size. */ int delim; /* In-line delimiters enabled. */ char odelim; /* In-line opening delimiter. */