From a055c5a463de86365cc98c7fec31a8184cbf1674 Mon Sep 17 00:00:00 2001 From: Ingo Schwarze Date: Tue, 16 Dec 2014 03:53:43 +0000 Subject: When a string comparison condition contains no mismatching character but ends without the final delimiter, the parse point was advanced one character too far and the invalid pointer returned to the caller of roff_parseln(). Later use could potentially advance the pointer even further and maybe even write to it. Fixing a buffer overrun found by jsg@ with afl (the most severe so far). --- roff.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'roff.c') diff --git a/roff.c b/roff.c index 37a03621..099f7503 100644 --- a/roff.c +++ b/roff.c @@ -1,4 +1,4 @@ -/* $Id: roff.c,v 1.241 2014/12/16 01:22:59 schwarze Exp $ */ +/* $Id: roff.c,v 1.242 2014/12/16 03:53:43 schwarze Exp $ */ /* * Copyright (c) 2010, 2011, 2012 Kristaps Dzonsons * Copyright (c) 2010-2014 Ingo Schwarze @@ -1236,7 +1236,7 @@ roff_evalstrcond(const char *v, int *pos) out: if (NULL == s3) s3 = strchr(s2, '\0'); - else + else if (*s3 != '\0') s3++; *pos = s3 - v; return(match); -- cgit v1.2.3