diff options
| author |   Ingo Schwarze <schwarze@openbsd.org> | 2015-01-01 19:28:49 +0000 |
|---|---|---|
| committer | Ingo Schwarze <schwarze@openbsd.org> | 2015-01-01 19:28:49 +0000 |
| commit | 5cdf519064e2a4e99ff35d500e68650cc82dfa4e (patch) | |
| tree | 7c9240853783cdf44298625b2d2ef419f90104cc /mandocdb.c | |
| parent | 031d1f01fc925d18b3af6e51565d51044023590b (diff) | |
| download | mandoc-5cdf519064e2a4e99ff35d500e68650cc82dfa4e.tar.gz mandoc-5cdf519064e2a4e99ff35d500e68650cc82dfa4e.tar.zst mandoc-5cdf519064e2a4e99ff35d500e68650cc82dfa4e.zip | |
Fix a buffer overrun triggered by a trailing backslash at EOF in
an unclosed conditional body. If the memory contained the byte
sequence "\}" after the end of the buffer before the next NUL, this
could even write beyond the end of the buffer, specifically '&' to
the location of the '}'. Found by jsg@ with afl.
Diffstat (limited to 'mandocdb.c')
0 files changed, 0 insertions, 0 deletions