diff options
| author | Ingo Schwarze <schwarze@openbsd.org> | 2022-04-13 13:19:34 +0000 |
|---|---|---|
| committer | Ingo Schwarze <schwarze@openbsd.org> | 2022-04-13 13:19:34 +0000 |
| commit | ca9bc03cff40f97d7cd61a8a1ad5f04878abee7a (patch) | |
| tree | 26610d2bdaaa6010c584a31ecdea9305ababb927 /roff.c | |
| parent | ef4cc03dbb7deeb4329a74e97c09433301435a54 (diff) | |
| download | mandoc-ca9bc03cff40f97d7cd61a8a1ad5f04878abee7a.tar.gz mandoc-ca9bc03cff40f97d7cd61a8a1ad5f04878abee7a.zip | |
Surprisingly, groff supports multiple copy mode escapes at the
beginning of an escape sequence: \, \E, \EE, \EEE, and so on all do
the same outside copy mode, so let them do the same in mandoc(1), too.
This fixes an assertion failure triggered by \EE*X that tb@ found
with afl(1). The first E was consumed by roff_expand(), but that
function failed to recognize the escape sequence as the expansion
of a user-defined string and handed it over to mandoc_escape(),
which consumed the second E and then died on an assertion because
it is not prepared to handle user-defined strings. Fix this by
letting *both* functions handle arbitrary numbers of 'E's correctly.
Diffstat (limited to 'roff.c')
| -rw-r--r-- | roff.c | 6 |
1 files changed, 3 insertions, 3 deletions
@@ -1,6 +1,6 @@ -/* $Id: roff.c,v 1.380 2021/10/04 14:19:14 schwarze Exp $ */ +/* $Id: roff.c,v 1.381 2022/04/13 13:19:34 schwarze Exp $ */ /* - * Copyright (c) 2010-2015, 2017-2021 Ingo Schwarze <schwarze@openbsd.org> + * Copyright (c) 2010-2015, 2017-2022 Ingo Schwarze <schwarze@openbsd.org> * Copyright (c) 2008-2012, 2014 Kristaps Dzonsons <kristaps@bsd.lv> * * Permission to use, copy, modify, and distribute this software for any @@ -1401,7 +1401,7 @@ roff_expand(struct roff *r, struct buf *buf, int ln, int pos, char newesc) term = '\0'; cp = stesc + 1; - if (*cp == 'E') + while (*cp == 'E') cp++; esct = cp; switch (*esct) { |