When a numerical condition errors out after consuming at least one
authorschwarze <schwarze@openbsd.org>
Tue, 16 Dec 2014 01:21:37 +0000 (01:21 +0000)
committerschwarze <schwarze@openbsd.org>
Tue, 16 Dec 2014 01:21:37 +0000 (01:21 +0000)
commit583f2f708eb980bf56e21300c8b146442523c787
treeeb7c4d54f7f92c1b2c5166facd2437ade7ade50f
parent9372b8fc4d2d6047cb6166e8b0ed927a14def84a
When a numerical condition errors out after consuming at least one
character of input, treat it as false, do not retry it as a string
comparison condition.  This also fixes a read buffer overrun that
happened when the numerical condition advanced to the end of the
input line before erroring out, found by jsg@ with afl.
regress/usr.bin/mandoc/roff/cond/numeric.in
regress/usr.bin/mandoc/roff/cond/numeric.out_ascii
usr.bin/mandoc/roff.c