===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/mandoc/main.c,v
retrieving revision 1.60
retrieving revision 1.61
diff -c -r1.60 -r1.61
*** src/usr.bin/mandoc/main.c	2010/12/02 20:40:43	1.60
--- src/usr.bin/mandoc/main.c	2010/12/09 23:01:18	1.61
***************
*** 1,4 ****
! /*	$Id: main.c,v 1.60 2010/12/02 20:40:43 schwarze Exp $ */
  /*
   * Copyright (c) 2008, 2009, 2010 Kristaps Dzonsons <kristaps@bsd.lv>
   * Copyright (c) 2010 Ingo Schwarze <schwarze@openbsd.org>
--- 1,4 ----
! /*	$Id: main.c,v 1.61 2010/12/09 23:01:18 schwarze Exp $ */
  /*
   * Copyright (c) 2008, 2009, 2010 Kristaps Dzonsons <kristaps@bsd.lv>
   * Copyright (c) 2010 Ingo Schwarze <schwarze@openbsd.org>
***************
*** 34,39 ****
--- 34,40 ----
  #include "man.h"
  #include "roff.h"
  
+ #define	REPARSE_LIMIT	1000
  #define	UNCONST(a)	((void *)(uintptr_t)(const void *)(a))
  
  typedef	void		(*out_mdoc)(void *, const struct mdoc *);
***************
*** 74,79 ****
--- 75,81 ----
  	struct mdoc	 *mdoc;		/* mdoc parser */
  	struct roff	 *roff;		/* roff parser (!NULL) */
  	struct regset	  regs;		/* roff registers */
+ 	int		  reparse_count; /* finite interpolation stack */
  	enum outt	  outtype; 	/* which output to use */
  	out_mdoc	  outmdoc;	/* mdoc output ptr */
  	out_man	  	  outman;	/* man output ptr */
***************
*** 162,167 ****
--- 164,170 ----
  
  	"generic error",
  
+ 	"input stack limit exceeded, infinite loop?",
  	"skipping bad character",
  	"skipping text before the first section header",
  	"skipping unknown macro",
***************
*** 651,658 ****
  		if (0 == pos && '\0' == blk.buf[i])
  			break;
  
! 		if (start)
  			curp->line = lnn;
  
  		while (i < (int)blk.sz && (start || '\0' != blk.buf[i])) {
  			if ('\n' == blk.buf[i]) {
--- 654,663 ----
  		if (0 == pos && '\0' == blk.buf[i])
  			break;
  
! 		if (start) {
  			curp->line = lnn;
+ 			curp->reparse_count = 0;
+ 		}
  
  		while (i < (int)blk.sz && (start || '\0' != blk.buf[i])) {
  			if ('\n' == blk.buf[i]) {
***************
*** 751,757 ****
  
  		switch (rr) {
  		case (ROFF_REPARSE):
! 			parsebuf(curp, ln, 0);
  			pos = 0;
  			continue;
  		case (ROFF_APPEND):
--- 756,766 ----
  
  		switch (rr) {
  		case (ROFF_REPARSE):
! 			if (REPARSE_LIMIT >= ++curp->reparse_count)
! 				parsebuf(curp, ln, 0);
! 			else
! 				mmsg(MANDOCERR_ROFFLOOP, curp, 
! 				    curp->line, pos, NULL);
  			pos = 0;
  			continue;
  		case (ROFF_APPEND):