diff options
| author |   Ingo Schwarze <schwarze@openbsd.org> | 2018-03-16 20:41:41 +0000 |
|---|---|---|
| committer | Ingo Schwarze <schwarze@openbsd.org> | 2018-03-16 20:41:41 +0000 |
| commit | 63ba33671bfb5f26d7f5742a00291b8436cb1b7d (patch) | |
| tree | aa4bdf010455a73814115ebc674e8bc0b2a5803e /mdoc_validate.c | |
| parent | bbd260dcd38e0e50fc5c35b6d65bf2caf4459198 (diff) | |
| download | mandoc-63ba33671bfb5f26d7f5742a00291b8436cb1b7d.tar.gz mandoc-63ba33671bfb5f26d7f5742a00291b8436cb1b7d.tar.zst mandoc-63ba33671bfb5f26d7f5742a00291b8436cb1b7d.zip | |
Ouch, fix previous: In the edge case of a single-character string
containing nothing but a single hyphen, the pointer got incremented
twice at one point, causing a read overrun found by naddy@.
Diffstat (limited to 'mdoc_validate.c')
| -rw-r--r-- | mdoc_validate.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/mdoc_validate.c b/mdoc_validate.c index a6e3d5e7..8ed827ea 100644 --- a/mdoc_validate.c +++ b/mdoc_validate.c @@ -1,4 +1,4 @@ -/* $Id: mdoc_validate.c,v 1.355 2018/03/16 15:05:44 schwarze Exp $ */ +/* $Id: mdoc_validate.c,v 1.356 2018/03/16 20:41:41 schwarze Exp $ */ /* * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps@bsd.lv> * Copyright (c) 2010-2018 Ingo Schwarze <schwarze@openbsd.org> @@ -412,8 +412,9 @@ check_text_em(struct roff_man *mdoc, int ln, int pos, char *p) /* Look for em-dashes wrongly encoded as "--". */ for (cp = p; *cp != '\0'; cp++) { - if (*cp != '-' || *++cp != '-') + if (cp[0] != '-' || cp[1] != '-') continue; + cp++; /* Skip input sequences of more than two '-'. */ |