diff options
| author | Ingo Schwarze <schwarze@openbsd.org> | 2015-01-01 19:28:49 +0000 |
|---|---|---|
| committer | Ingo Schwarze <schwarze@openbsd.org> | 2015-01-01 19:28:49 +0000 |
| commit | c147a10e9238c3d84c374dadb602444272da1d10 (patch) | |
| tree | 9e5c12d5335f4dbda8253d8c8108d701cfeaabc9 /mdoc_html.c | |
| parent | 0c4268a97d14f67e1ac6cff32d0a418723ac49cd (diff) | |
| download | mandoc-c147a10e9238c3d84c374dadb602444272da1d10.tar.gz | |
Fix a buffer overrun triggered by a trailing backslash at EOF in
an unclosed conditional body. If the memory contained the byte
sequence "\}" after the end of the buffer before the next NUL, this
could even write beyond the end of the buffer, specifically '&' to
the location of the '}'. Found by jsg@ with afl.
Diffstat (limited to 'mdoc_html.c')
0 files changed, 0 insertions, 0 deletions