diff options
| author |   schwarze <schwarze@openbsd.org> | 2017-07-13 15:12:47 +0000 |
|---|---|---|
| committer | schwarze <schwarze@openbsd.org> | 2017-07-13 15:12:47 +0000 |
| commit | 0164722439baee77eb25e46f15b7797c5c347fb7 (patch) | |
| tree | 93f722b4afa3d7fd725a3b7035c7c732b1cdbcda | |
| parent | Set the ipl of pipex pools to IPL_SOFTNET. (diff) | |
| download | wireguard-openbsd-0164722439baee77eb25e46f15b7797c5c347fb7.tar.xz wireguard-openbsd-0164722439baee77eb25e46f15b7797c5c347fb7.zip | |
eqn(7) .EQ has to break man(7) next-line scope, or tree corruption
and use after free many ensue; again found by jsg@ with afl(1)
| -rw-r--r-- | usr.bin/mandoc/roff.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/usr.bin/mandoc/roff.c b/usr.bin/mandoc/roff.c index cfbbcfce88c..36684901665 100644 --- a/usr.bin/mandoc/roff.c +++ b/usr.bin/mandoc/roff.c @@ -1,4 +1,4 @@ -/* $OpenBSD: roff.c,v 1.193 2017/07/08 17:52:42 schwarze Exp $ */ +/* $OpenBSD: roff.c,v 1.194 2017/07/13 15:12:47 schwarze Exp $ */ /* * Copyright (c) 2008-2012, 2014 Kristaps Dzonsons <kristaps@bsd.lv> * Copyright (c) 2010-2015, 2017 Ingo Schwarze <schwarze@openbsd.org> @@ -2877,6 +2877,8 @@ roff_EQ(ROFF_ARGS) { struct roff_node *n; + if (r->man->macroset == MACROSET_MAN) + man_breakscope(r->man, ROFF_EQ); n = roff_node_alloc(r->man, ln, ppos, ROFFT_EQN, TOKEN_NONE); if (ln > r->man->last->line) n->flags |= NODE_LINE; |