From 4f2ec2ae5810c381eebe5bda1abb21eaf53144dc Mon Sep 17 00:00:00 2001 From: Ingo Schwarze Date: Tue, 19 Mar 2019 16:26:08 +0000 Subject: When the last line of the input is empty and the previous line reduced the line input buffer to a length of one byte, do not write one byte past the end of the line input buffer. Minimal code to show the bug: printf ".ds X\n.X\n\n" | MALLOC_OPTIONS=C mandoc Bug found by bentley@ in the sysutils/rancid par(1) manual page. --- read.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'read.c') diff --git a/read.c b/read.c index a3a1f982..b9d67854 100644 --- a/read.c +++ b/read.c @@ -1,4 +1,4 @@ -/* $Id: read.c,v 1.211 2019/01/11 17:04:44 schwarze Exp $ */ +/* $Id: read.c,v 1.212 2019/03/19 16:26:08 schwarze Exp $ */ /* * Copyright (c) 2008, 2009, 2010, 2011 Kristaps Dzonsons * Copyright (c) 2010-2019 Ingo Schwarze @@ -255,6 +255,8 @@ mparse_buf_r(struct mparse *curp, struct buf blk, size_t i, int start) /* XXX Ugly hack to mark the end of the input. */ if (i == blk.sz || blk.buf[i] == '\0') { + if (pos + 2 > ln.sz) + resize_buf(&ln, 256); ln.buf[pos++] = '\n'; ln.buf[pos] = '\0'; } -- cgit v1.2.3-56-ge451