[src/trunk]: src/external/bsd/mdocml/dist Set the maximum column index in a t...

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/30a56b6db25e
branches:  trunk
changeset: 997875:30a56b6db25e
user:      christos <christos%NetBSD.org@localhost>
date:      Fri Mar 29 22:00:31 2019 +0000

description:
Set the maximum column index in a tbl(7) to the maximum *right* edge
of any cell span, not to the maximum *left* edge, which may be smaller
if the last column of the table is only reached by horizontal spans,
but not by any regular cell in any row of the table.
Otherwise, the algorithm calculating column widths accessed memomy
after the end of the colwidth[] array, while it was trying to handle
the rightmost column(s).

Crash reported by Jason Thorpe <thorpej at NetBSD>
via https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=54069
and via Thomas Klausner (wiz@).
Christos@ Zoulas sent a (correct, but slightly confusing) patch.
The patch i'm committing here is easier to understand.

diffstat:

 external/bsd/mdocml/dist/out.c |  5 +----
 1 files changed, 1 insertions(+), 4 deletions(-)

diffs (22 lines):

diff -r 1c8f87042be6 -r 30a56b6db25e external/bsd/mdocml/dist/out.c
--- a/external/bsd/mdocml/dist/out.c    Fri Mar 29 21:51:52 2019 +0000
+++ b/external/bsd/mdocml/dist/out.c    Fri Mar 29 22:00:31 2019 +0000
@@ -149,7 +149,7 @@
                gp = &first_group;
                for (dp = sp->first; dp != NULL; dp = dp->next) {
                        icol = dp->layout->col;
-                       while (icol > maxcol)
+                       while (maxcol < icol + dp->hspans)
                                tbl->cols[++maxcol].spacing = SIZE_MAX;
                        col = tbl->cols + icol;
                        col->flags |= dp->layout->flags;
@@ -235,9 +235,6 @@
                        } else
                                (*gp)->wanted -= width;
                }
-               if (g->endcol > maxcol) {
-                       maxcol = g->endcol;
-               }
                if (done) {
                        *gp = g->next;
                        free(g);