Differences From Artifact [2e11c24257]:

• File src/markdown_html.c — part of check-in [c5456211f4] at 2022-04-21 21:13:22 on branch markdown-footnotes — Fix another use-after-realloc bug in handling of inline footnotes which was discovered during fuzzing. Also fix a few other issues revealed via fuzzer. (user: george size: 25838)

To Artifact [38a90709de]:

• File src/markdown_html.c — part of check-in [cab8a586ae] at 2022-04-22 12:49:06 on branch markdown-footnotes — Remove redundant assert() that fails for the case when the content of a span-bounded inline footnote is rendered into a void. This is a corner case that was revealed via fuzzing. (user: george size: 25879) [more...]

481
482
483
484
485
486
487
488
489
490
491
492
493
494
495

    char pos[24];
    int bJoin = 0;
    #define _joined_footnote_indicator "<ul class='fn-joined'>"
    #define _jfi_sz (sizeof(_joined_footnote_indicator)-1)
    /* make.footnote_item() invocations should pass args accordingly */
    const struct Blob *upc = text+1;
    assert( text );
    assert( blob_size(text) );
    memset(pos,0,24);
    sprintf(pos, "%s-%d", unique, iMark);
    blob_appendf(ob, "<li id='footnote%s' class='", pos);
    if( nUsed ){
      if( blob_size(text)>=_jfi_sz &&
         !memcmp(blob_buffer(text),_joined_footnote_indicator,_jfi_sz)){
        bJoin = 1;

|

481
482
483
484
485
486
487
488
489
490
491
492
493
494
495

    char pos[24];
    int bJoin = 0;
    #define _joined_footnote_indicator "<ul class='fn-joined'>"
    #define _jfi_sz (sizeof(_joined_footnote_indicator)-1)
    /* make.footnote_item() invocations should pass args accordingly */
    const struct Blob *upc = text+1;
    assert( text );
    /* allow blob_size(text)==0 for constructs like  [...](^ [] ())  */
    memset(pos,0,24);
    sprintf(pos, "%s-%d", unique, iMark);
    blob_appendf(ob, "<li id='footnote%s' class='", pos);
    if( nUsed ){
      if( blob_size(text)>=_jfi_sz &&
         !memcmp(blob_buffer(text),_joined_footnote_indicator,_jfi_sz)){
        bJoin = 1;