diff options
author | Ingo Schwarze <schwarze@openbsd.org> | 2015-01-01 19:28:49 +0000 |
---|---|---|
committer | Ingo Schwarze <schwarze@openbsd.org> | 2015-01-01 19:28:49 +0000 |
commit | 5cdf519064e2a4e99ff35d500e68650cc82dfa4e (patch) | |
tree | 7c9240853783cdf44298625b2d2ef419f90104cc /msec.c | |
parent | 031d1f01fc925d18b3af6e51565d51044023590b (diff) | |
download | mandoc-5cdf519064e2a4e99ff35d500e68650cc82dfa4e.tar.gz mandoc-5cdf519064e2a4e99ff35d500e68650cc82dfa4e.tar.zst mandoc-5cdf519064e2a4e99ff35d500e68650cc82dfa4e.zip |
Fix a buffer overrun triggered by a trailing backslash at EOF in
an unclosed conditional body. If the memory contained the byte
sequence "\}" after the end of the buffer before the next NUL, this
could even write beyond the end of the buffer, specifically '&' to
the location of the '}'. Found by jsg@ with afl.
Diffstat (limited to 'msec.c')
0 files changed, 0 insertions, 0 deletions