From 282fe21ce6f22578f85b7b8addcd20b3f99f40fe Mon Sep 17 00:00:00 2001
From: Ingo Schwarze <schwarze@openbsd.org>
Date: Wed, 1 Aug 2018 13:46:15 +0000
Subject: Avoid a read access one byte beyond the end of an allocated string
 which occurred in situations like ".Fl a Cm --"; found by Leah Neukirchen
 <leah at vuxu dot org> with valgrind on Void Linux.

---
 mdoc_validate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'mdoc_validate.c')

diff --git a/mdoc_validate.c b/mdoc_validate.c
index d455523e..f4381800 100644
--- a/mdoc_validate.c
+++ b/mdoc_validate.c
@@ -1,4 +1,4 @@
-/*	$Id: mdoc_validate.c,v 1.358 2018/04/11 17:11:13 schwarze Exp $ */
+/*	$Id: mdoc_validate.c,v 1.359 2018/08/01 13:46:15 schwarze Exp $ */
 /*
  * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010-2018 Ingo Schwarze <schwarze@openbsd.org>
@@ -440,7 +440,7 @@ check_text_em(struct roff_man *mdoc, int ln, int pos, char *p)
 		     np->string != '\0' &&
 		     isalpha((unsigned char)np->string[
 		       strlen(np->string) - 1])) ||
-		    (cp[2] != '\0' ?
+		    (cp[1] != '\0' && cp[2] != '\0' ?
 		     isalpha((unsigned char)cp[2]) :
 		     nn != NULL &&
 		     nn->type == ROFFT_TEXT &&
-- 
cgit v1.2.3