Address issue #479: fix crash on empty Markdown headings#482
Merged
Conversation
Typing a lone setext underline ('-' or '=') on a new line — e.g. a
trailing '-' after a blank line — made Hoedown emit a heading with empty
content. The patched heading renderers created the slug buffer with
hoedown_buffer_new(content->size), so an empty heading produced a buffer
with a zero growth "unit". The fallback HOEDOWN_BUFPUTSL(slug, "section")
then grew that buffer and tripped Hoedown's assert(buf && buf->unit),
aborting the app on the background render queue (SIGABRT).
Clamp the size hint via a new_growable_buffer() helper so derived buffers
are always growable, and apply it to render_header, render_toc_header,
and the analogous block-code info-string buffers.
Adds regression tests rendering a lone '-', a lone '=', the reported
input, and an empty heading with TOC enabled through the real render
path.
Related to #479
Contributor
Code Coverage ReportCurrent Coverage: 62.70% Coverage Details (Summary) |
PR #430 copied the slug/heading-id logic into the Quick Look renderer (mp_quicklook_render_header), including the same hoedown_buffer_new( content->size) call. An empty heading (e.g. a bare setext underline) therefore creates a zero-unit buffer that aborts the Quick Look render process the first time it is written to — the same defect just fixed in hoedown_html_patch.c, reachable by previewing a .md file in Finder. Clamp the size hint with a mp_quicklook_new_growable_buffer() helper mirroring new_growable_buffer(), and add a regression test rendering a bare '-' heading through the Quick Look renderer. Related to #479
schuyler
added a commit
that referenced
this pull request
Jun 30, 2026
schuyler
added
the
rc-pending
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Typing a lone setext underline (
-or=) on an otherwise-empty line crashed the app. The crash is a Cassert()(SIGABRT) inside Hoedown'shoedown_buffer_grow—assert(buf && buf->unit)— reached from MacDown's patched heading renderer, running onMPRenderer's background renderNSOperationQueue(matching the faulting thread in the report).A bare
-/=makes Hoedown emit a heading with empty content. The patched heading renderers built the slug buffer withhoedown_buffer_new(content->size), so an empty heading produced a buffer with a zero growth unit. The fallbackHOEDOWN_BUFPUTSL(slug, "section")then grew that buffer and tripped the assert. Minimal reproduction: a document containing only-(or only=); the reported_ - _ - _ -\n-\n\n-ends in exactly such a trailing lone-.I reproduced this directly by building Hoedown 3.0.7 with the MacDown patch and rendering the reported input — it aborts in
hoedown_buffer_putfromhoedown_patch_render_header, with the second header callback receivingcontent->size == 0.Root cause / origin
Introduced in 0.7-rc.1 by the slug-based heading IDs change (#430). Before #430 there was no custom
headercallback, so Hoedown's built-in renderer handled empty headings harmlessly. #430 both added the custom renderer and sized its working buffer from the heading content length, which is0for an empty heading.The same slug/heading logic was copied verbatim into the Quick Look renderer in #430, so it carried the identical crash — reachable by previewing a
.mdfile with a bare-/=heading in Finder/Spotlight. That copy is fixed here too.Changes
MacDown/Code/Extension/hoedown_html_patch.c— add anew_growable_buffer()helper that clamps a zero size hint to a non-zero unit; use it inhoedown_patch_render_header,hoedown_patch_render_toc_header, and the analogous block-code info-string buffers.MacDownCore/MPQuickLookRenderer.m— same fix via a mirroredmp_quicklook_new_growable_buffer()helper formp_quicklook_render_header.MacDownTests/MPMarkdownRenderingTests.m— regression tests rendering a lone-, a lone=, the exact reported input, and an empty heading with TOC enabled, all through the real render path.MacDownTests/MPQuickLookRendererTests.m— regression test rendering a bare-heading through the Quick Look renderer.After the fix, an empty heading renders as
<h2 id="section"></h2>(no crash) and normal headings keep their slugs; verified across the preview and TOC paths and the Quick Look renderer.Related Issue
Related to #479. The regression originates in #430 (slug-based heading IDs). The reporter arrived here while exercising the selection-count thread in #452, which is a separate, unrelated issue.
Manual Testing Plan
-on the first line → must not crash; preview shows an (empty) heading.=alone on a line → must not crash.-last → must not crash.# Hello,## Foo Bar) still render with correct slug ids (id="hello",id="foo-bar").[TOC]) in a document that also contains an empty heading → must not crash; TOC links resolve..mdfile whose content is just-and press Space (Quick Look) → preview renders without the Quick Look process aborting.Review Notes
parseMarkdown:/Quick Look render paths, so before the fix they abort the test process and after it they pass.#toc_Nto#<slug>, so duplicate heading texts collapse to the same id (already pinned by an existing test) — flagged for a possible future slug-dedup, not a crash.