diff options
| author | Ingo Schwarze <schwarze@openbsd.org> | 2015-01-01 18:11:45 +0000 |
|---|---|---|
| committer | Ingo Schwarze <schwarze@openbsd.org> | 2015-01-01 18:11:45 +0000 |
| commit | 0c4268a97d14f67e1ac6cff32d0a418723ac49cd (patch) | |
| tree | ec035401b6da655c1dd82b175503403607676add /mandoc.c | |
| parent | ef53727c250e97b0412d4f51253d6e017464507f (diff) | |
| download | mandoc-0c4268a97d14f67e1ac6cff32d0a418723ac49cd.tar.gz | |
Fix a read buffer overrun triggered by trailing \s- or trailing \s+
without the required subsequent argument; found by jsg@ with afl.
Diffstat (limited to 'mandoc.c')
| -rw-r--r-- | mandoc.c | 6 |
1 files changed, 3 insertions, 3 deletions
@@ -1,7 +1,7 @@ /* $Id$ */ /* - * Copyright (c) 2008, 2009, 2010, 2011 Kristaps Dzonsons <kristaps@bsd.lv> - * Copyright (c) 2011, 2012, 2013, 2014 Ingo Schwarze <schwarze@openbsd.org> + * Copyright (c) 2008-2011, 2014 Kristaps Dzonsons <kristaps@bsd.lv> + * Copyright (c) 2011-2015 Ingo Schwarze <schwarze@openbsd.org> * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -225,7 +225,7 @@ mandoc_escape(const char **end, const char **start, int *sz) /* See +/- counts as a sign. */ if ('+' == **end || '-' == **end || ASCII_HYPH == **end) - (*end)++; + *start = ++*end; switch (**end) { case '(': |