diff options
| author |   schwarze <schwarze@openbsd.org> | 2017-07-31 15:18:59 +0000 |
|---|---|---|
| committer | schwarze <schwarze@openbsd.org> | 2017-07-31 15:18:59 +0000 |
| commit | 43359c3888ae349d506330cc217f04a93b04adda (patch) | |
| tree | 5c9c18a173eeddde172db762a25a51909e4dc255 /usr.bin/mandoc/mdoc_validate.c | |
| parent | Replace OCTEON_MAXCPUS with MAXCPUS to avoid redundancy. (diff) | |
| download | wireguard-openbsd-43359c3888ae349d506330cc217f04a93b04adda.tar.xz wireguard-openbsd-43359c3888ae349d506330cc217f04a93b04adda.zip | |
Fix an out of bounds read access to a constant array that caused
segfaults on certain hardened versions of glibc. Triggered by .sp
or blank lines right before .SS or .SH, or before the first .Sh.
Found the hard way by Dr. Markus Waldner on Debian
and by Leah Neukirchen on Void Linux.
Diffstat (limited to 'usr.bin/mandoc/mdoc_validate.c')
| -rw-r--r-- | usr.bin/mandoc/mdoc_validate.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/usr.bin/mandoc/mdoc_validate.c b/usr.bin/mandoc/mdoc_validate.c index e0de8b6e8f2..2ea8d606bbf 100644 --- a/usr.bin/mandoc/mdoc_validate.c +++ b/usr.bin/mandoc/mdoc_validate.c @@ -1,4 +1,4 @@ -/* $OpenBSD: mdoc_validate.c,v 1.265 2017/07/20 12:53:55 schwarze Exp $ */ +/* $OpenBSD: mdoc_validate.c,v 1.266 2017/07/31 15:18:59 schwarze Exp $ */ /* * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps@bsd.lv> * Copyright (c) 2010-2017 Ingo Schwarze <schwarze@openbsd.org> @@ -1916,7 +1916,7 @@ post_root(POST_ARGS) /* Check that we begin with a proper `Sh'. */ n = mdoc->first->child; - while (n != NULL && n->tok != TOKEN_NONE && + while (n != NULL && n->tok >= MDOC_Dd && mdoc_macros[n->tok].flags & MDOC_PROLOGUE) n = n->next; |