mdocml: When a string comparison condition contains no mismatching

mdocml: When a string comparison condition contains no mismatching

[schwarze]

Log Message:
-----------
When a string comparison condition contains no mismatching character
but ends without the final delimiter, the parse point was advanced 
one character too far and the invalid pointer returned to the 
caller of roff_parseln().  Later use could potentially advance 
the pointer even further and maybe even write to it.
Fixing a buffer overrun found by jsg@ with afl (the most severe so far).

Modified Files:
--------------
    mdocml:
        roff.c

Revision Data
-------------
Index: roff.c
===================================================================
RCS file: /home/cvs/mdocml/mdocml/roff.c,v
retrieving revision 1.241
retrieving revision 1.242
diff -Lroff.c -Lroff.c -u -p -r1.241 -r1.242
--- roff.c
+++ roff.c
@@ -1236,7 +1236,7 @@ roff_evalstrcond(const char *v, int *pos
 out:
 	if (NULL == s3)
 		s3 = strchr(s2, '\0');
-	else
+	else if (*s3 != '\0')
 		s3++;
 	*pos = s3 - v;
 	return(match);
--
 To unsubscribe send an email to source+unsubscribe@mdocml.bsd.lv