From d036545502790e3a57d7219369aa50fe0c686589 Mon Sep 17 00:00:00 2001 From: schwarze Date: Wed, 1 Aug 2018 15:39:47 +0000 Subject: [PATCH] After rewriting the parse buffer from scratch, we also have to reset the parse point to the beginning of the new buffer or we risk out of bounds accesses. Bug found by Leah Neukirchen with valgrind on Void Linux. --- usr.bin/mandoc/roff.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usr.bin/mandoc/roff.c b/usr.bin/mandoc/roff.c index e0b5ed67f46..2e4e9c11757 100644 --- a/usr.bin/mandoc/roff.c +++ b/usr.bin/mandoc/roff.c @@ -1,4 +1,4 @@ -/* $OpenBSD: roff.c,v 1.200 2018/04/11 17:10:35 schwarze Exp $ */ +/* $OpenBSD: roff.c,v 1.201 2018/08/01 15:39:47 schwarze Exp $ */ /* * Copyright (c) 2008-2012, 2014 Kristaps Dzonsons * Copyright (c) 2010-2015, 2017, 2018 Ingo Schwarze @@ -2843,6 +2843,7 @@ roff_TE(ROFF_ARGS) free(buf->buf); buf->buf = mandoc_strdup(".sp"); buf->sz = 4; + *offs = 0; return ROFF_REPARSE; } r->tbl = NULL; @@ -3362,6 +3363,7 @@ roff_userdef(ROFF_ARGS) ln, (int)(cp - n1), NULL); free(buf->buf); buf->buf = n1; + *offs = 0; return ROFF_IGN; } @@ -3456,6 +3458,7 @@ roff_renamed(ROFF_ARGS) buf->buf[pos] == '\0' ? "" : " ", buf->buf + pos) + 1; free(buf->buf); buf->buf = nbuf; + *offs = 0; return ROFF_CONT; } -- 2.20.1