summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorIngo Schwarze <schwarze@openbsd.org>2018-08-01 13:46:15 +0000
committerIngo Schwarze <schwarze@openbsd.org>2018-08-01 13:46:15 +0000
commit160e978ed219fefc76edebd7f7d3ed55ed7e74fd (patch)
tree54ca67df1335486e9ccfb09fce8285d90d843c8b
parentf5da3327ebbc63db1b7c9b2660235b22740f301b (diff)
downloadmandoc-160e978ed219fefc76edebd7f7d3ed55ed7e74fd.tar.gz
Avoid a read access one byte beyond the end of an allocated string
which occurred in situations like ".Fl a Cm --"; found by Leah Neukirchen <leah at vuxu dot org> with valgrind on Void Linux.
-rw-r--r--NEWS4
-rw-r--r--mdoc_validate.c2
2 files changed, 3 insertions, 3 deletions
diff --git a/NEWS b/NEWS
index cf99c0c5..ed318d89 100644
--- a/NEWS
+++ b/NEWS
@@ -59,8 +59,8 @@ Changes in version 1.14.4, released on August XXX, 2018
on diagnostic messages and on the documentation.
* Thomas Klausner (NetBSD) for suggesting two new style messages,
one new feature, and for two bug reports.
- * Leah Neukirchen (Void Linux) for suggesting a new style message
- and for two bug reports.
+ * Leah Neukirchen (Void Linux) for suggesting a new style message,
+ four bug reports, and release testing.
* Anthony Bentley (OpenBSD) for reporting multiple bugs and missing
features.
* Paul Irofti (OpenBSD) and Nate Bargmann for suggesting new features.
diff --git a/mdoc_validate.c b/mdoc_validate.c
index 05d78391..5ab5f3ae 100644
--- a/mdoc_validate.c
+++ b/mdoc_validate.c
@@ -440,7 +440,7 @@ check_text_em(struct roff_man *mdoc, int ln, int pos, char *p)
np->string != '\0' &&
isalpha((unsigned char)np->string[
strlen(np->string) - 1])) ||
- (cp[2] != '\0' ?
+ (cp[1] != '\0' && cp[2] != '\0' ?
isalpha((unsigned char)cp[2]) :
nn != NULL &&
nn->type == ROFFT_TEXT &&