diff options
author | Ingo Schwarze <schwarze@openbsd.org> | 2013-05-30 03:52:59 +0000 |
---|---|---|
committer | Ingo Schwarze <schwarze@openbsd.org> | 2013-05-30 03:52:59 +0000 |
commit | a46db8d6dd0bb86c956e7c8fc3a7966c89e7d078 (patch) | |
tree | 6112be5e9369cb89dfa86e6c2ff728e1f14e0ad9 | |
parent | a63d21dde30a8fa447b23c76761b0dc6d28c8387 (diff) | |
download | mandoc-a46db8d6dd0bb86c956e7c8fc3a7966c89e7d078.tar.gz mandoc-a46db8d6dd0bb86c956e7c8fc3a7966c89e7d078.tar.zst mandoc-a46db8d6dd0bb86c956e7c8fc3a7966c89e7d078.zip |
Reject non-printable characters found in the input stream even when
preceded by a backslash; otherwise, the escape sequence would later
be identified as invalid and the non-printable character would be
passed through to the output backends, sometimes triggering assertions.
Reported by Mike Small <smallm at panix dot com> on the mdocml discuss list.
-rw-r--r-- | read.c | 33 |
1 files changed, 24 insertions, 9 deletions
@@ -1,7 +1,7 @@ -/* $Id: read.c,v 1.34 2012/11/19 22:30:58 schwarze Exp $ */ +/* $Id: read.c,v 1.35 2013/05/30 03:52:59 schwarze Exp $ */ /* * Copyright (c) 2008, 2009, 2010, 2011 Kristaps Dzonsons <kristaps@bsd.lv> - * Copyright (c) 2010, 2011, 2012 Ingo Schwarze <schwarze@openbsd.org> + * Copyright (c) 2010, 2011, 2012, 2013 Ingo Schwarze <schwarze@openbsd.org> * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -328,6 +328,15 @@ mparse_buf_r(struct mparse *curp, struct buf blk, int start) break; } + /* + * Make sure we have space for at least + * one backslash and one other character + * and the trailing NUL byte. + */ + + if (pos + 2 >= (int)ln.sz) + resize_buf(&ln, 256); + /* * Warn about bogus characters. If you're using * non-ASCII encoding, you're screwing your @@ -344,8 +353,6 @@ mparse_buf_r(struct mparse *curp, struct buf blk, int start) mandoc_msg(MANDOCERR_BADCHAR, curp, curp->line, pos, NULL); i++; - if (pos >= (int)ln.sz) - resize_buf(&ln, 256); ln.buf[pos++] = '?'; continue; } @@ -353,8 +360,6 @@ mparse_buf_r(struct mparse *curp, struct buf blk, int start) /* Trailing backslash = a plain char. */ if ('\\' != blk.buf[i] || i + 1 == (int)blk.sz) { - if (pos >= (int)ln.sz) - resize_buf(&ln, 256); ln.buf[pos++] = blk.buf[i++]; continue; } @@ -396,10 +401,20 @@ mparse_buf_r(struct mparse *curp, struct buf blk, int start) break; } - /* Some other escape sequence, copy & cont. */ + /* Catch escaped bogus characters. */ - if (pos + 1 >= (int)ln.sz) - resize_buf(&ln, 256); + c = (unsigned char) blk.buf[i+1]; + + if ( ! (isascii(c) && + (isgraph(c) || isblank(c)))) { + mandoc_msg(MANDOCERR_BADCHAR, curp, + curp->line, pos, NULL); + i += 2; + ln.buf[pos++] = '?'; + continue; + } + + /* Some other escape sequence, copy & cont. */ ln.buf[pos++] = blk.buf[i++]; ln.buf[pos++] = blk.buf[i++]; |