aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/tag.c
diff options
context:
space:
mode:
authorIngo Schwarze <schwarze@openbsd.org>2017-02-17 03:03:03 +0000
committerIngo Schwarze <schwarze@openbsd.org>2017-02-17 03:03:03 +0000
commit73d13e32f24d114d25e566580496bd3b8c246ce6 (patch)
treeb364b2d59e1a2c9a4a0b283b6188b9575b918834 /tag.c
parent5d300ed80a7af7469ecdab91d541d5282a5288b5 (diff)
downloadmandoc-73d13e32f24d114d25e566580496bd3b8c246ce6.tar.gz
mandoc-73d13e32f24d114d25e566580496bd3b8c246ce6.tar.zst
mandoc-73d13e32f24d114d25e566580496bd3b8c246ce6.zip
Fix a read buffer overrun that copied random data from memory into
text nodes when a string passed to deroff() ended in a backslash and the byte after the terminating NUL was non-NUL, found by tb@ with afl(1). Invalid bytes so copied with the high bit set could later sometimes trigger another out of bounds read access to static memory in roff_strdup(), so add an assertion there to abort safely in case of similar data corruption.
Diffstat (limited to 'tag.c')
0 files changed, 0 insertions, 0 deletions