From ea3e75363c1a526374ce4922e3ad0823294ef755 Mon Sep 17 00:00:00 2001 From: Ingo Schwarze Date: Mon, 31 Jul 2017 15:19:06 +0000 Subject: Fix an out of bounds read access to a constant array that caused segfaults on certain hardened versions of glibc. Triggered by .sp or blank lines right before .SS or .SH, or before the first .Sh. Found the hard way by Dr. Markus Waldner on Debian and by Leah Neukirchen on Void Linux. --- man_term.c | 6 +++--- mdoc_validate.c | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/man_term.c b/man_term.c index fcdb45df..8946a050 100644 --- a/man_term.c +++ b/man_term.c @@ -1,4 +1,4 @@ -/* $Id: man_term.c,v 1.208 2017/06/25 11:42:02 schwarze Exp $ */ +/* $Id: man_term.c,v 1.209 2017/07/31 15:19:06 schwarze Exp $ */ /* * Copyright (c) 2008-2012 Kristaps Dzonsons * Copyright (c) 2010-2015, 2017 Ingo Schwarze @@ -673,7 +673,7 @@ pre_SS(DECL_ARGS) do { n = n->prev; - } while (n != NULL && n->tok != TOKEN_NONE && + } while (n != NULL && n->tok >= MAN_TH && termacts[n->tok].flags & MAN_NOTEXT); if (n == NULL || (n->tok == MAN_SS && n->body->child == NULL)) break; @@ -735,7 +735,7 @@ pre_SH(DECL_ARGS) do { n = n->prev; - } while (n != NULL && n->tok != TOKEN_NONE && + } while (n != NULL && n->tok >= MAN_TH && termacts[n->tok].flags & MAN_NOTEXT); if (n == NULL || (n->tok == MAN_SH && n->body->child == NULL)) break; diff --git a/mdoc_validate.c b/mdoc_validate.c index de36bb84..decb4ee1 100644 --- a/mdoc_validate.c +++ b/mdoc_validate.c @@ -1,4 +1,4 @@ -/* $Id: mdoc_validate.c,v 1.350 2017/07/20 12:54:02 schwarze Exp $ */ +/* $Id: mdoc_validate.c,v 1.351 2017/07/31 15:19:06 schwarze Exp $ */ /* * Copyright (c) 2008-2012 Kristaps Dzonsons * Copyright (c) 2010-2017 Ingo Schwarze @@ -1931,7 +1931,7 @@ post_root(POST_ARGS) /* Check that we begin with a proper `Sh'. */ n = mdoc->first->child; - while (n != NULL && n->tok != TOKEN_NONE && + while (n != NULL && n->tok >= MDOC_Dd && mdoc_macros[n->tok].flags & MDOC_PROLOGUE) n = n->next; -- cgit v1.2.3-56-ge451