diff options
| author |   Ingo Schwarze <schwarze@openbsd.org> | 2019-03-19 16:26:08 +0000 |
|---|---|---|
| committer | Ingo Schwarze <schwarze@openbsd.org> | 2019-03-19 16:26:08 +0000 |
| commit | 4f2ec2ae5810c381eebe5bda1abb21eaf53144dc (patch) | |
| tree | f4fc89b618ac45dc39965f673d63f70d06ca30de /read.c | |
| parent | 5e859b1a66b94c8cf3ee617d521d7031687d509c (diff) | |
| download | mandoc-4f2ec2ae5810c381eebe5bda1abb21eaf53144dc.tar.gz mandoc-4f2ec2ae5810c381eebe5bda1abb21eaf53144dc.tar.zst mandoc-4f2ec2ae5810c381eebe5bda1abb21eaf53144dc.zip | |
When the last line of the input is empty and the previous line reduced
the line input buffer to a length of one byte, do not write one byte
past the end of the line input buffer. Minimal code to show the bug:
printf ".ds X\n.X\n\n" | MALLOC_OPTIONS=C mandoc
Bug found by bentley@ in the sysutils/rancid par(1) manual page.
Diffstat (limited to 'read.c')
| -rw-r--r-- | read.c | 4 |
1 files changed, 3 insertions, 1 deletions
@@ -1,4 +1,4 @@ -/* $Id: read.c,v 1.211 2019/01/11 17:04:44 schwarze Exp $ */ +/* $Id: read.c,v 1.212 2019/03/19 16:26:08 schwarze Exp $ */ /* * Copyright (c) 2008, 2009, 2010, 2011 Kristaps Dzonsons <kristaps@bsd.lv> * Copyright (c) 2010-2019 Ingo Schwarze <schwarze@openbsd.org> @@ -255,6 +255,8 @@ mparse_buf_r(struct mparse *curp, struct buf blk, size_t i, int start) /* XXX Ugly hack to mark the end of the input. */ if (i == blk.sz || blk.buf[i] == '\0') { + if (pos + 2 > ln.sz) + resize_buf(&ln, 256); ln.buf[pos++] = '\n'; ln.buf[pos] = '\0'; } |