diff options
| author | Ingo Schwarze <schwarze@cvs.openbsd.org> | 2015-02-07 16:39:45 +0000 |
|---|---|---|
| committer | Ingo Schwarze <schwarze@cvs.openbsd.org> | 2015-02-07 16:39:45 +0000 |
| commit | 9346336895333d222dfbccb197db3460bc9d04ad (patch) | |
| tree | 508a86481a76c263ce0fab6122d1f4b94e26c948 /usr.bin/mandoc/mdoc_macro.c | |
| parent | 04a679220725963f422913fd43fbe0a491f816a9 (diff) | |
Closing a block validates it, which may end up deleting it,
so if we are in a loop over blocks, cleanly restart the loop
rather than risking use after free; found by jsg@ with afl.
Diffstat (limited to 'usr.bin/mandoc/mdoc_macro.c')
| -rw-r--r-- | usr.bin/mandoc/mdoc_macro.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/usr.bin/mandoc/mdoc_macro.c b/usr.bin/mandoc/mdoc_macro.c index 4dcd103c929..a2fbde9f8e7 100644 --- a/usr.bin/mandoc/mdoc_macro.c +++ b/usr.bin/mandoc/mdoc_macro.c @@ -1,4 +1,4 @@ -/* $OpenBSD: mdoc_macro.c,v 1.135 2015/02/06 07:12:34 schwarze Exp $ */ +/* $OpenBSD: mdoc_macro.c,v 1.136 2015/02/07 16:39:44 schwarze Exp $ */ /* * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps@bsd.lv> * Copyright (c) 2010, 2012-2015 Ingo Schwarze <schwarze@openbsd.org> @@ -939,6 +939,7 @@ blk_full(MACRO_PROT_ARGS) mdoc_macronames[tok], mdoc_macronames[n->tok]); rew_pending(mdoc, n); + n = mdoc->last; continue; case MDOC_It: /* Delay in case it's astray. */ |