Fix a buffer overrun in the roff(7) escape sequence parser that could

[mandoc.git] / roff.c

diff --git a/roff.c b/roff.c
index aa42e87de713774a5be1b302a82600d3a11f5c22..83701f7d936979e3b768d4cc0aea3cce18eaa6c8 100644 (file)
--- a/roff.c
+++ b/roff.c
@@ -1,4 +1,4 @@
-/* $Id: roff.c,v 1.388 2022/05/19 15:37:47 schwarze Exp $ */
+/* $Id: roff.c,v 1.391 2022/05/31 20:23:05 schwarze Exp $ */
 /*
  * Copyright (c) 2010-2015, 2017-2022 Ingo Schwarze <schwarze@openbsd.org>
  * Copyright (c) 2008-2012, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
@@ -1520,6 +1520,11 @@ roff_expand(struct roff *r, struct buf *buf, int ln, int pos, char ec)
                                        *dst++ = '"';
                        }
                        continue;
+               case 'A':
+                       ubuf[0] = iendarg > iarg ? '1' : '0';
+                       ubuf[1] = '\0';
+                       res = ubuf;
+                       break;
                case 'B':
                        npos = 0;
                        ubuf[0] = iendarg > iarg && iend > iendarg &&
@@ -1529,6 +1534,14 @@ roff_expand(struct roff *r, struct buf *buf, int ln, int pos, char ec)
                        ubuf[1] = '\0';
                        res = ubuf;
                        break;
+               case 'V':
+                       mandoc_msg(MANDOCERR_UNSUPP, ln, iesc,
+                           "%.*s", iend - iesc, buf->buf + iesc);
+                       roff_expand_patch(buf, iendarg, "}", iend);
+                       roff_expand_patch(buf, iesc, "${", iarg);
+                       continue;
+               case 'g':
+                       break;
                case 'n':
                        if (iendarg > iarg)
                                (void)snprintf(ubuf, sizeof(ubuf), "%d",
@@ -1567,9 +1580,8 @@ roff_expand_patch(struct buf *buf, int start, const char *repl, int end)
 {
        char    *nbuf;
 
-       buf->buf[start] = '\0';
-       buf->sz = mandoc_asprintf(&nbuf, "%s%s%s", buf->buf, repl,
-           buf->buf + end) + 1;
+       buf->sz = mandoc_asprintf(&nbuf, "%.*s%s%s", start, buf->buf,
+           repl, buf->buf + end) + 1;
        free(buf->buf);
        buf->buf = nbuf;
 }