When undoing complete block from ctx->block_bytesp[], reset ctx->current_block properly. Fixes #74.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f7b24e2..1bce543 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,9 @@ Fixes:
* [#73](https://github.com/mity/md4c/issues/73):
Some raw HTML inputs could lead to quadratic parsing times.
+ * [#74](https://github.com/mity/md4c/issues/74):
+ Fix input leading to a crash. Found by fuzzing.
+
## Version 0.3.2
diff --git a/md4c/md4c.c b/md4c/md4c.c
index 374331b..90dab3f 100644
--- a/md4c/md4c.c
+++ b/md4c/md4c.c
@@ -4739,6 +4739,7 @@ md_consume_link_reference_definitions(MD_CTX* ctx)
/* Remove complete block. */
ctx->n_block_bytes -= n * sizeof(MD_LINE);
ctx->n_block_bytes -= sizeof(MD_BLOCK);
+ ctx->current_block = NULL;
} else {
/* Remove just some initial lines from the block. */
memmove(lines, lines + n, (n_lines - n) * sizeof(MD_LINE));
@@ -4765,8 +4766,11 @@ md_end_current_block(MD_CTX* ctx)
(ctx->current_block->type == MD_BLOCK_H && (ctx->current_block->flags & MD_BLOCK_SETEXT_HEADER)))
{
MD_LINE* lines = (MD_LINE*) (ctx->current_block + 1);
- if(CH(lines[0].beg) == _T('['))
+ if(CH(lines[0].beg) == _T('[')) {
MD_CHECK(md_consume_link_reference_definitions(ctx));
+ if(ctx->current_block == NULL)
+ return ret;
+ }
}
if(ctx->current_block->type == MD_BLOCK_H && (ctx->current_block->flags & MD_BLOCK_SETEXT_HEADER)) {
diff --git a/test/coverage.txt b/test/coverage.txt
index ab26400..c7dc4ac 100644
--- a/test/coverage.txt
+++ b/test/coverage.txt
@@ -151,6 +151,21 @@ __x_ _x___
````````````````````````````````
+### [Issue 74](https://github.com/mity/md4c/issues/74)
+```````````````````````````````` example
+[f]:
+-
+ xx
+-
+.
+<pre><code>xx
+</code></pre>
+<ul>
+<li></li>
+</ul>
+````````````````````````````````
+
+
## Code coverage