md_lookup_line: Advance to the next line even if the offset... falls into a gap between two lines, instead of returning NULL. Fixes NULL dereference in md_is_link_reference(). This was a regression in 2e9b13cc512b5984b010a7934253702a6763f4f7.
diff --git a/src/md4c.c b/src/md4c.c
index 1af50b7..7fdc8e2 100644
--- a/src/md4c.c
+++ b/src/md4c.c
@@ -465,6 +465,8 @@ md_text_with_null_replacement(MD_CTX* ctx, MD_TEXTTYPE type, const CHAR* str, SZ
} while(0)
+/* If the offset falls into a gap between line, we return the following
+ * line. */
static const MD_LINE*
md_lookup_line(OFF off, const MD_LINE* lines, int n_lines)
{
@@ -481,11 +483,9 @@ md_lookup_line(OFF off, const MD_LINE* lines, int n_lines)
if(off < line->beg) {
hi = pivot - 1;
if(hi < 0 || lines[hi].end <= off)
- return NULL;
+ return line;
} else if(off > line->end) {
lo = pivot + 1;
- if(lo > n_lines || lines[lo].beg > off)
- return NULL;
} else {
return line;
}