diff options
| author |   schwarze <schwarze@openbsd.org> | 2018-03-16 20:41:19 +0000 |
|---|---|---|
| committer | schwarze <schwarze@openbsd.org> | 2018-03-16 20:41:19 +0000 |
| commit | dfdd4af9b9ddebe68de953ac76dfca7fd197a2d7 (patch) | |
| tree | fe9f1119e25f84148da17e170f39d0ddf9183172 /usr.bin/mandoc/mdoc_validate.c | |
| parent | clarify what the route priority does and what defaults are used. (diff) | |
| download | wireguard-openbsd-dfdd4af9b9ddebe68de953ac76dfca7fd197a2d7.tar.xz wireguard-openbsd-dfdd4af9b9ddebe68de953ac76dfca7fd197a2d7.zip | |
Ouch, fix previous: In the edge case of a single-character string
containing nothing but a single hyphen, the pointer got incremented
twice at one point, causing a read overrun found by naddy@.
Diffstat (limited to 'usr.bin/mandoc/mdoc_validate.c')
| -rw-r--r-- | usr.bin/mandoc/mdoc_validate.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/usr.bin/mandoc/mdoc_validate.c b/usr.bin/mandoc/mdoc_validate.c index 8c13c2a1f39..f3dd48996fa 100644 --- a/usr.bin/mandoc/mdoc_validate.c +++ b/usr.bin/mandoc/mdoc_validate.c @@ -1,4 +1,4 @@ -/* $OpenBSD: mdoc_validate.c,v 1.270 2018/03/16 15:05:33 schwarze Exp $ */ +/* $OpenBSD: mdoc_validate.c,v 1.271 2018/03/16 20:41:19 schwarze Exp $ */ /* * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps@bsd.lv> * Copyright (c) 2010-2018 Ingo Schwarze <schwarze@openbsd.org> @@ -410,8 +410,9 @@ check_text_em(struct roff_man *mdoc, int ln, int pos, char *p) /* Look for em-dashes wrongly encoded as "--". */ for (cp = p; *cp != '\0'; cp++) { - if (*cp != '-' || *++cp != '-') + if (cp[0] != '-' || cp[1] != '-') continue; + cp++; /* Skip input sequences of more than two '-'. */ |