Bugfix in roff_setstrn():

Do not call strcmp() on an array of char that might not be NUL-terminated.

1 files changed, 2 insertions, 1 deletions

diff --git a/roff.c b/roff.c
index e29df8fd..48eaf047 100644
--- a/roff.c
+++ b/roff.c
@@ -2068,7 +2068,8 @@ roff_setstrn(struct roffkv **r, const char *name, size_t namesz,
 	/* Search for an existing string with the same name. */
 	n = *r;
 
-	while (n && strcmp(name, n->key.p))
+	while (n && (namesz != n->key.sz ||
+			strncmp(n->key.p, name, namesz)))
 		n = n->next;
 
 	if (NULL == n) {