Commit 4358c40ab740ed13b12921464467e6a90a689950

Martin Mitas 2022-01-11T10:28:06

md_lookup_line: Advance to the next line even if the offset... falls into a gap between two lines, instead of returning NULL. Fixes NULL dereference in md_is_link_reference(). This was a regression in 2e9b13cc512b5984b010a7934253702a6763f4f7.

diff --git a/src/md4c.c b/src/md4c.c
index 1af50b7..7fdc8e2 100644
--- a/src/md4c.c
+++ b/src/md4c.c
@@ -465,6 +465,8 @@ md_text_with_null_replacement(MD_CTX* ctx, MD_TEXTTYPE type, const CHAR* str, SZ
     } while(0)
 
 
+/* If the offset falls into a gap between line, we return the following
+ * line. */
 static const MD_LINE*
 md_lookup_line(OFF off, const MD_LINE* lines, int n_lines)
 {
@@ -481,11 +483,9 @@ md_lookup_line(OFF off, const MD_LINE* lines, int n_lines)
         if(off < line->beg) {
             hi = pivot - 1;
             if(hi < 0  ||  lines[hi].end <= off)
-                return NULL;
+                return line;
         } else if(off > line->end) {
             lo = pivot + 1;
-            if(lo > n_lines  ||  lines[lo].beg > off)
-                return NULL;
         } else {
             return line;
         }