mischief/openbsd-src
1
0
Fork 0
mirror of https://github.com/openbsd/src.git synced 2025-01-10 06:47:55 -08:00
Code

When the last line of the input is empty and the previous line reduced

Browse Source 
the line input buffer to a length of one byte, do not write one byte
past the end of the line input buffer.  Minimal code to show the bug:
printf ".ds X\n.X\n\n" | MALLOC_OPTIONS=C mandoc
Bug found by bentley@ in the sysutils/rancid par(1) manual page.
This commit is contained in:
schwarze 2019-03-19 16:25:38 +00:00
parent 9beccd0fdb
commit 18b6272148
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
usr.bin/mandoc/read.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: read.c,v 1.182 2019/01/11 17:03:43 schwarze Exp $ */
/* $OpenBSD: read.c,v 1.183 2019/03/19 16:25:38 schwarze Exp $ */
/*
* Copyright (c) 2008, 2009, 2010, 2011 Kristaps Dzonsons <kristaps@bsd.lv>
* Copyright (c) 2010-2019 Ingo Schwarze <schwarze@openbsd.org>
@ -253,6 +253,8 @@ mparse_buf_r(struct mparse *curp, struct buf blk, size_t i, int start)
/* XXX Ugly hack to mark the end of the input. */
if (i == blk.sz || blk.buf[i] == '\0') {
if (pos + 2 > ln.sz)
resize_buf(&ln, 256);
ln.buf[pos++] = '\n';
ln.buf[pos] = '\0';
}