diff options
| author | Ingo Schwarze <schwarze@openbsd.org> | 2018-03-16 20:41:41 +0000 |
|---|---|---|
| committer | Ingo Schwarze <schwarze@openbsd.org> | 2018-03-16 20:41:41 +0000 |
| commit | b59f9b9322a3cf804a69a50993cd75f5b6882ef5 (patch) | |
| tree | f694940b97093fdd155cd96e3ec06bc79fe0f583 | |
| parent | 40ab8f177b08eb4563008c1d93980c0eb4ec3304 (diff) | |
| download | mandoc-b59f9b9322a3cf804a69a50993cd75f5b6882ef5.tar.gz | |
Ouch, fix previous: In the edge case of a single-character string
containing nothing but a single hyphen, the pointer got incremented
twice at one point, causing a read overrun found by naddy@.
| -rw-r--r-- | mdoc_validate.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/mdoc_validate.c b/mdoc_validate.c index 489c5adf..54342b98 100644 --- a/mdoc_validate.c +++ b/mdoc_validate.c @@ -412,8 +412,9 @@ check_text_em(struct roff_man *mdoc, int ln, int pos, char *p) /* Look for em-dashes wrongly encoded as "--". */ for (cp = p; *cp != '\0'; cp++) { - if (*cp != '-' || *++cp != '-') + if (cp[0] != '-' || cp[1] != '-') continue; + cp++; /* Skip input sequences of more than two '-'. */ |