Fix a buffer overrun triggered by a trailing backslash at EOF in
authorschwarze <schwarze@openbsd.org>
Thu, 1 Jan 2015 19:28:29 +0000 (19:28 +0000)
committerschwarze <schwarze@openbsd.org>
Thu, 1 Jan 2015 19:28:29 +0000 (19:28 +0000)
commit1a5d26ae4bbfe5c0d2618b1acac1d61d58e451f4
tree418097e710039c41e0eddbd87a86ec0f2311cbaa
parent50dbfa23f5f1aa959bc1ca73770fab1f89caf3be
Fix a buffer overrun triggered by a trailing backslash at EOF in
an unclosed conditional body.  If the memory contained the byte
sequence "\}" after the end of the buffer before the next NUL, this
could even write beyond the end of the buffer, specifically '&' to
the location of the '}'.  Found by jsg@ with afl.
usr.bin/mandoc/roff.c