Bug#1067022: man2html: Segmentation fault with tzfile(5)

[Paul Eggert]

On 2024-03-16 16:06, Alejandro Colomar wrote:

BTW, I noticed that the upstream homepage is dead:
<http://users.actrix.gen.nz/michael/vhman2html.html>.
Is this project defunct?

Yes it is. It's been defunct for many years.

Attached is a patch for this particular bug. However, a brief code 
inspection suggests there are lots more core dumps where this came from.

man2html should be discontinued from Debian if nobody wants to maintain 
it, as I don't. There are plenty of substitutes for it, starting with 
groff itself.
--- man-1.6g-debian/man2html/man2html.c	2024-03-17 18:14:12.360162014 -0700
+++ man-1.6g-debian-fix/man2html/man2html.c	2024-03-17 21:21:23.145134418 -0700
@@ -1282,9 +1282,8 @@
     return c;
 }
 
-char *scan_expression(char *c, int *result) {
-    int value=0,value2,sign=1,opex=0;
-    char oper='c';
+static char *scan_if_expression(char *c, int *result) {
+    int value=0;
 
     if (*c=='!') {
 	c=scan_expression(c+1, &value);
@@ -1328,6 +1327,16 @@
 	if (tcmp) c=c+3;
 	c++;
     } else {
+	return scan_expression(c, result);
+    }
+    *result=value;
+    return c;
+}
+
+char *scan_expression(char *c, int *result) {
+	int value=0,value2,sign=1,opex=0;
+	char oper='c';
+
 	while (*c && !isspace(*c) && *c!=')') {
 	    opex=0;
 	    switch (*c) {
@@ -1414,9 +1423,8 @@
 	    }
 	}
 	if (*c==')') c++;
-    }
-    *result=value;
-    return c;
+	*result=value;
+	return c;
 }
 
 static void
@@ -1956,7 +1964,7 @@
 	     * .if !'string1'string2' anything
 	     */
 	    c=c+j;
-	    c=scan_expression(c, &i);
+	    c=scan_if_expression(c, &i);
 	    ifelseval=!i;
 	    if (i) {
 		*c='\n';