Fix a buffer overrun in the roff(7) escape sequence parser that could

[mandoc.git] / roff.c

diff --git a/roff.c b/roff.c
index 0c36e08e24bcacfa8e9268c9b23634ae924a1c0a..83701f7d936979e3b768d4cc0aea3cce18eaa6c8 100644 (file)
--- a/roff.c
+++ b/roff.c
@@ -1,4 +1,4 @@
-/* $Id: roff.c,v 1.390 2022/05/31 18:09:57 schwarze Exp $ */
+/* $Id: roff.c,v 1.391 2022/05/31 20:23:05 schwarze Exp $ */
 /*
  * Copyright (c) 2010-2015, 2017-2022 Ingo Schwarze <schwarze@openbsd.org>
  * Copyright (c) 2008-2012, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
@@ -1520,6 +1520,11 @@ roff_expand(struct roff *r, struct buf *buf, int ln, int pos, char ec)
                                        *dst++ = '"';
                        }
                        continue;
+               case 'A':
+                       ubuf[0] = iendarg > iarg ? '1' : '0';
+                       ubuf[1] = '\0';
+                       res = ubuf;
+                       break;
                case 'B':
                        npos = 0;
                        ubuf[0] = iendarg > iarg && iend > iendarg &&