From: schwarze <schwarze@openbsd.org>
Date: Tue, 30 Aug 2016 21:58:59 +0000 (+0000)
Subject: When the database is corrupt in the sense of containing invalid
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=e252f3d93711cba459ff82f84837c2502cffb2a0;p=openbsd

When the database is corrupt in the sense of containing invalid
pointers in the pages table, do not access NULL pointers, but
gracefully handle the errors.
Similar patches will be needed for the macro tables, too.
<attila at stalphonsos dot com> audited the code and pointed out to me
that dbm_get() can return NULL for corrupted databases, but that isn't
handled properly at various places.
---

diff --git a/usr.bin/mandoc/dbm.c b/usr.bin/mandoc/dbm.c
index 3334a2ce366..e4c707bcacc 100644
--- a/usr.bin/mandoc/dbm.c
+++ b/usr.bin/mandoc/dbm.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dbm.c,v 1.1 2016/08/01 10:32:39 schwarze Exp $ */
+/*	$OpenBSD: dbm.c,v 1.2 2016/08/30 21:58:59 schwarze Exp $ */
 /*
  * Copyright (c) 2016 Ingo Schwarze <schwarze@openbsd.org>
  *
@@ -140,10 +140,18 @@ dbm_page_get(int32_t ip)
 	assert(ip >= 0);
 	assert(ip < npages);
 	res.name = dbm_get(pages[ip].name);
+	if (res.name == NULL)
+		res.name = "(NULL)";
 	res.sect = dbm_get(pages[ip].sect);
+	if (res.sect == NULL)
+		res.sect = "(NULL)";
 	res.arch = pages[ip].arch ? dbm_get(pages[ip].arch) : NULL;
 	res.desc = dbm_get(pages[ip].desc);
+	if (res.desc == NULL)
+		res.desc = "(NULL)";
 	res.file = dbm_get(pages[ip].file);
+	if (res.file == NULL)
+		res.file = " (NULL)";
 	res.addr = dbm_addr(pages + ip);
 	return &res;
 }
@@ -240,7 +248,13 @@ page_bytitle(enum iter arg_iter, const struct dbm_match *arg_match)
 		default:
 			abort();
 		}
-		ip = 0;
+		if (cp == NULL) {
+			iteration = ITER_NONE;
+			match = NULL;
+			cp = NULL;
+			ip = npages;
+		} else
+			ip = 0;
 		return res;
 	}