Commit 952791318f60437ac4724b43021113e049b171f7

Martin Mitas 2019-04-30T00:32:36

When undoing complete block from ctx->block_bytesp[], reset ctx->current_block properly. Fixes #74.

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f7b24e2..1bce543 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,9 @@ Fixes:
  * [#73](https://github.com/mity/md4c/issues/73):
    Some raw HTML inputs could lead to quadratic parsing times.
 
+ * [#74](https://github.com/mity/md4c/issues/74):
+   Fix input leading to a crash. Found by fuzzing.
+
 
 ## Version 0.3.2
 
diff --git a/md4c/md4c.c b/md4c/md4c.c
index 374331b..90dab3f 100644
--- a/md4c/md4c.c
+++ b/md4c/md4c.c
@@ -4739,6 +4739,7 @@ md_consume_link_reference_definitions(MD_CTX* ctx)
             /* Remove complete block. */
             ctx->n_block_bytes -= n * sizeof(MD_LINE);
             ctx->n_block_bytes -= sizeof(MD_BLOCK);
+            ctx->current_block = NULL;
         } else {
             /* Remove just some initial lines from the block. */
             memmove(lines, lines + n, (n_lines - n) * sizeof(MD_LINE));
@@ -4765,8 +4766,11 @@ md_end_current_block(MD_CTX* ctx)
        (ctx->current_block->type == MD_BLOCK_H  &&  (ctx->current_block->flags & MD_BLOCK_SETEXT_HEADER)))
     {
         MD_LINE* lines = (MD_LINE*) (ctx->current_block + 1);
-        if(CH(lines[0].beg) == _T('['))
+        if(CH(lines[0].beg) == _T('[')) {
             MD_CHECK(md_consume_link_reference_definitions(ctx));
+            if(ctx->current_block == NULL)
+                return ret;
+        }
     }
 
     if(ctx->current_block->type == MD_BLOCK_H  &&  (ctx->current_block->flags & MD_BLOCK_SETEXT_HEADER)) {
diff --git a/test/coverage.txt b/test/coverage.txt
index ab26400..c7dc4ac 100644
--- a/test/coverage.txt
+++ b/test/coverage.txt
@@ -151,6 +151,21 @@ __x_ _x___
 ````````````````````````````````
 
 
+### [Issue 74](https://github.com/mity/md4c/issues/74)
+```````````````````````````````` example
+[f]:
+-
+    xx
+-
+.
+<pre><code>xx
+</code></pre>
+<ul>
+<li></li>
+</ul>
+````````````````````````````````
+
+
 
 ## Code coverage