diff options
| author | Ingo Schwarze <schwarze@cvs.openbsd.org> | 2019-03-19 16:25:39 +0000 |
|---|---|---|
| committer | Ingo Schwarze <schwarze@cvs.openbsd.org> | 2019-03-19 16:25:39 +0000 |
| commit | 02351808c25717e5b8793a83977a07527eb19d73 (patch) | |
| tree | 4c8599b977a7ac0fa3485ee96d36907ce1329c31 /usr.bin/mandoc/read.c | |
| parent | 6200a1e883c39fe8dd946165b2e6e964b95d9074 (diff) | |
When the last line of the input is empty and the previous line reduced
the line input buffer to a length of one byte, do not write one byte
past the end of the line input buffer. Minimal code to show the bug:
printf ".ds X\n.X\n\n" | MALLOC_OPTIONS=C mandoc
Bug found by bentley@ in the sysutils/rancid par(1) manual page.
Diffstat (limited to 'usr.bin/mandoc/read.c')
| -rw-r--r-- | usr.bin/mandoc/read.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/usr.bin/mandoc/read.c b/usr.bin/mandoc/read.c index 0f082d57385..19b7f86804d 100644 --- a/usr.bin/mandoc/read.c +++ b/usr.bin/mandoc/read.c @@ -1,4 +1,4 @@ -/* $OpenBSD: read.c,v 1.182 2019/01/11 17:03:43 schwarze Exp $ */ +/* $OpenBSD: read.c,v 1.183 2019/03/19 16:25:38 schwarze Exp $ */ /* * Copyright (c) 2008, 2009, 2010, 2011 Kristaps Dzonsons <kristaps@bsd.lv> * Copyright (c) 2010-2019 Ingo Schwarze <schwarze@openbsd.org> @@ -253,6 +253,8 @@ mparse_buf_r(struct mparse *curp, struct buf blk, size_t i, int start) /* XXX Ugly hack to mark the end of the input. */ if (i == blk.sz || blk.buf[i] == '\0') { + if (pos + 2 > ln.sz) + resize_buf(&ln, 256); ln.buf[pos++] = '\n'; ln.buf[pos] = '\0'; } |