diff options
| author | Ingo Schwarze <schwarze@cvs.openbsd.org> | 2017-07-13 15:12:48 +0000 |
|---|---|---|
| committer | Ingo Schwarze <schwarze@cvs.openbsd.org> | 2017-07-13 15:12:48 +0000 |
| commit | afc8f417ff4d6e6421303bd7edf67c92ac99b858 (patch) | |
| tree | 9d5df02b914149a874baff20124da74e7b1c63f0 /usr.bin/mandoc | |
| parent | 601d555689559241044fd3d8a85dc3e4d3d35e49 (diff) | |
eqn(7) .EQ has to break man(7) next-line scope, or tree corruption
and use after free many ensue; again found by jsg@ with afl(1)
Diffstat (limited to 'usr.bin/mandoc')
| -rw-r--r-- | usr.bin/mandoc/roff.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/usr.bin/mandoc/roff.c b/usr.bin/mandoc/roff.c index cfbbcfce88c..36684901665 100644 --- a/usr.bin/mandoc/roff.c +++ b/usr.bin/mandoc/roff.c @@ -1,4 +1,4 @@ -/* $OpenBSD: roff.c,v 1.193 2017/07/08 17:52:42 schwarze Exp $ */ +/* $OpenBSD: roff.c,v 1.194 2017/07/13 15:12:47 schwarze Exp $ */ /* * Copyright (c) 2008-2012, 2014 Kristaps Dzonsons <kristaps@bsd.lv> * Copyright (c) 2010-2015, 2017 Ingo Schwarze <schwarze@openbsd.org> @@ -2877,6 +2877,8 @@ roff_EQ(ROFF_ARGS) { struct roff_node *n; + if (r->man->macroset == MACROSET_MAN) + man_breakscope(r->man, ROFF_EQ); n = roff_node_alloc(r->man, ln, ppos, ROFFT_EQN, TOKEN_NONE); if (ln > r->man->last->line) n->flags |= NODE_LINE; |