While doing delayed expansion of escape sequences in macro arguments,

correctly check for failure of the in-place expansion function.
If an argument not only does recursive delayed expansion
but infinitely recursive delayed expansion, this bug could
result in an ESCAPE_EXPAND assertion failure.

Thanks to Eric van Gyzen <vangyzen at FreeBSD> for finding this bug
by inspecting FreeBSD source code.

1 files changed, 1 insertions, 1 deletions

diff --git a/roff.c b/roff.c
index 3c1a3089..0005b999 100644
--- a/roff.c
+++ b/roff.c
@@ -1689,7 +1689,7 @@ roff_getarg(struct roff *r, char **cpp, int ln, int *pos)
 	buf.buf = start;
 	buf.sz = strlen(start) + 1;
 	buf.next = NULL;
-	if (roff_expand(r, &buf, ln, 0, '\\') & ROFF_IGN) {
+	if (roff_expand(r, &buf, ln, 0, '\\') == ROFF_IGN) {
 		free(buf.buf);
 		buf.buf = mandoc_strdup("");
 	}