CVSROOT: /cvs Module name: src Changes by: schwa...@cvs.openbsd.org 2015/01/01 12:28:29
Modified files:
usr.bin/mandoc : roff.c
Log message:
Fix a buffer overrun triggered by a trailing backslash at EOF in
an unclosed conditional body. If the memory contained the byte
sequence "\}" after the end of the buffer before the next NUL, this
could even write beyond the end of the buffer, specifically '&' to
the location of the '}'. Found by jsg@ with afl.
