diff options
| author |   Ingo Schwarze <schwarze@openbsd.org> | 2017-07-13 15:13:18 +0000 |
|---|---|---|
| committer | Ingo Schwarze <schwarze@openbsd.org> | 2017-07-13 15:13:18 +0000 |
| commit | 4332dc956a3f583d1ddb558e9b58542659887b7b (patch) | |
| tree | 1bf1372add25b29ee2c96467cd972facdbc7da78 /roff.c | |
| parent | 5b9fac5e713255fd71fe6d4dfb25ad29e2db9413 (diff) | |
| download | mandoc-4332dc956a3f583d1ddb558e9b58542659887b7b.tar.gz mandoc-4332dc956a3f583d1ddb558e9b58542659887b7b.tar.zst mandoc-4332dc956a3f583d1ddb558e9b58542659887b7b.zip | |
eqn(7) .EQ has to break man(7) next-line scope, or tree corruption
and use after free many ensue; again found by jsg@ with afl(1)
Diffstat (limited to 'roff.c')
| -rw-r--r-- | roff.c | 4 |
1 files changed, 3 insertions, 1 deletions
@@ -1,4 +1,4 @@ -/* $Id: roff.c,v 1.321 2017/07/08 17:52:50 schwarze Exp $ */ +/* $Id: roff.c,v 1.322 2017/07/13 15:13:18 schwarze Exp $ */ /* * Copyright (c) 2008-2012, 2014 Kristaps Dzonsons <kristaps@bsd.lv> * Copyright (c) 2010-2015, 2017 Ingo Schwarze <schwarze@openbsd.org> @@ -2879,6 +2879,8 @@ roff_EQ(ROFF_ARGS) { struct roff_node *n; + if (r->man->macroset == MACROSET_MAN) + man_breakscope(r->man, ROFF_EQ); n = roff_node_alloc(r->man, ln, ppos, ROFFT_EQN, TOKEN_NONE); if (ln > r->man->last->line) n->flags |= NODE_LINE; |