From 7d9f4162b65729ec0a1223a1051f0292dec0e975 Mon Sep 17 00:00:00 2001 From: Ingo Schwarze Date: Thu, 22 Jan 2015 19:26:50 +0000 Subject: Don't let a failing mparse_open() clobber the filename pointer; fixes error message content and a use after free for .so with non-existent target when -Wall or -Tlint is given. --- read.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/read.c b/read.c index 67c0027d..8580f8de 100644 --- a/read.c +++ b/read.c @@ -1,4 +1,4 @@ -/* $Id: read.c,v 1.112 2015/01/20 21:16:51 schwarze Exp $ */ +/* $Id: read.c,v 1.113 2015/01/22 19:26:50 schwarze Exp $ */ /* * Copyright (c) 2008, 2009, 2010, 2011 Kristaps Dzonsons * Copyright (c) 2010-2015 Ingo Schwarze @@ -307,6 +307,7 @@ mparse_buf_r(struct mparse *curp, struct buf blk, size_t i, int start) { const struct tbl_span *span; struct buf ln; + const char *save_file; char *cp; size_t pos; /* byte number in the ln buffer */ enum rofferr rr; @@ -522,11 +523,14 @@ rerun: */ if (curp->secondary) curp->secondary->sz -= pos + 1; + save_file = curp->file; save_child = curp->child; if (mparse_open(curp, &fd, ln.buf + of) == - MANDOCLEVEL_OK) + MANDOCLEVEL_OK) { mparse_readfd(curp, fd, ln.buf + of); - else { + curp->file = save_file; + } else { + curp->file = save_file; mandoc_vmsg(MANDOCERR_SO_FAIL, curp, curp->line, pos, ".so %s", ln.buf + of); -- cgit v1.2.3-56-ge451