diff options
| author |   schwarze <schwarze@openbsd.org> | 2015-01-01 19:28:29 +0000 |
|---|---|---|
| committer | schwarze <schwarze@openbsd.org> | 2015-01-01 19:28:29 +0000 |
| commit | 1a5d26ae4bbfe5c0d2618b1acac1d61d58e451f4 (patch) | |
| tree | 418097e710039c41e0eddbd87a86ec0f2311cbaa | |
| parent | Fix a read buffer overrun triggered by trailing \s- or trailing \s+ (diff) | |
| download | wireguard-openbsd-1a5d26ae4bbfe5c0d2618b1acac1d61d58e451f4.tar.xz wireguard-openbsd-1a5d26ae4bbfe5c0d2618b1acac1d61d58e451f4.zip | |
Fix a buffer overrun triggered by a trailing backslash at EOF in
an unclosed conditional body. If the memory contained the byte
sequence "\}" after the end of the buffer before the next NUL, this
could even write beyond the end of the buffer, specifically '&' to
the location of the '}'. Found by jsg@ with afl.
| -rw-r--r-- | usr.bin/mandoc/roff.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/usr.bin/mandoc/roff.c b/usr.bin/mandoc/roff.c index 65b43948f6f..d7d1ff61ca9 100644 --- a/usr.bin/mandoc/roff.c +++ b/usr.bin/mandoc/roff.c @@ -1,7 +1,7 @@ -/* $OpenBSD: roff.c,v 1.118 2014/12/28 14:16:07 schwarze Exp $ */ +/* $OpenBSD: roff.c,v 1.119 2015/01/01 19:28:29 schwarze Exp $ */ /* - * Copyright (c) 2010, 2011, 2012 Kristaps Dzonsons <kristaps@bsd.lv> - * Copyright (c) 2010-2014 Ingo Schwarze <schwarze@openbsd.org> + * Copyright (c) 2010, 2011, 2012, 2014 Kristaps Dzonsons <kristaps@bsd.lv> + * Copyright (c) 2010-2015 Ingo Schwarze <schwarze@openbsd.org> * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -1161,7 +1161,8 @@ roff_cond_sub(ROFF_ARGS) *ep = '&'; roff_ccond(r, ln, ep - buf->buf - 1); } - ++ep; + if (*ep != '\0') + ++ep; } return(rr ? ROFF_CONT : ROFF_IGN); } @@ -1181,7 +1182,8 @@ roff_cond_text(ROFF_ARGS) *ep = '&'; roff_ccond(r, ln, ep - buf->buf - 1); } - ++ep; + if (*ep != '\0') + ++ep; } return(rr ? ROFF_CONT : ROFF_IGN); } |