From dfaf51896b71ba07d68f2a0d996bdc9c9264e1a4 Mon Sep 17 00:00:00 2001 From: Ingo Schwarze Date: Wed, 1 Aug 2018 15:40:17 +0000 Subject: After rewriting the parse buffer from scratch, we also have to reset the parse point to the beginning of the new buffer or we risk out of bounds accesses. Bug found by Leah Neukirchen with valgrind on Void Linux. --- roff.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'roff.c') diff --git a/roff.c b/roff.c index 21d80083..c6d7dad1 100644 --- a/roff.c +++ b/roff.c @@ -2845,6 +2845,7 @@ roff_TE(ROFF_ARGS) free(buf->buf); buf->buf = mandoc_strdup(".sp"); buf->sz = 4; + *offs = 0; return ROFF_REPARSE; } r->tbl = NULL; @@ -3364,6 +3365,7 @@ roff_userdef(ROFF_ARGS) ln, (int)(cp - n1), NULL); free(buf->buf); buf->buf = n1; + *offs = 0; return ROFF_IGN; } @@ -3458,6 +3460,7 @@ roff_renamed(ROFF_ARGS) buf->buf[pos] == '\0' ? "" : " ", buf->buf + pos) + 1; free(buf->buf); buf->buf = nbuf; + *offs = 0; return ROFF_CONT; } -- cgit