diff options
| author | Ingo Schwarze <schwarze@cvs.openbsd.org> | 2014-12-16 03:52:32 +0000 |
|---|---|---|
| committer | Ingo Schwarze <schwarze@cvs.openbsd.org> | 2014-12-16 03:52:32 +0000 |
| commit | d27765dfd6a73ed5f832f3d101b36d6372910e1c (patch) | |
| tree | 1f370d6a731515f743bf81687819a77261b95ca7 /usr.bin/mandoc | |
| parent | 663a84b8fd5f3d0f3eedcd133222d8680920c26b (diff) | |
When a string comparison condition contains no mismatching character
but ends without the final delimiter, the parse point was advanced
one character too far and the invalid pointer returned to the
caller of roff_parseln(). Later use could potentially advance
the pointer even further and maybe even write to it.
Fixing a buffer overrun found by jsg@ with afl (the most severe so far).
Diffstat (limited to 'usr.bin/mandoc')
| -rw-r--r-- | usr.bin/mandoc/roff.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/usr.bin/mandoc/roff.c b/usr.bin/mandoc/roff.c index e7d9795cde0..9f85d50e756 100644 --- a/usr.bin/mandoc/roff.c +++ b/usr.bin/mandoc/roff.c @@ -1,4 +1,4 @@ -/* $OpenBSD: roff.c,v 1.113 2014/12/16 01:21:37 schwarze Exp $ */ +/* $OpenBSD: roff.c,v 1.114 2014/12/16 03:52:31 schwarze Exp $ */ /* * Copyright (c) 2010, 2011, 2012 Kristaps Dzonsons <kristaps@bsd.lv> * Copyright (c) 2010-2014 Ingo Schwarze <schwarze@openbsd.org> @@ -1234,7 +1234,7 @@ roff_evalstrcond(const char *v, int *pos) out: if (NULL == s3) s3 = strchr(s2, '\0'); - else + else if (*s3 != '\0') s3++; *pos = s3 - v; return(match); |