mdocml: Fix blunder in previous: we must keep the line parse buffer

mdocml: Fix blunder in previous: we must keep the line parse buffer

[schwarze]

Log Message:
-----------
Fix blunder in previous:  we must keep the line parse buffer 
consistent even when aborting the parsing of the line.  That buffer
is not our own, but owned and reused by mparse_buf_r(), read.c.
Returning without cleanup leaked memory and caused write overruns 
of the old, typically much smaller buffer in mparse_buf_r().
Promptly noticed by tb@ with afl(1), using MALLOC_OPTIONS=C.

Modified Files:
--------------
    mdocml:
        roff.c

Revision Data
-------------
Index: roff.c
===================================================================
RCS file: /home/cvs/mdocml/mdocml/roff.c,v
retrieving revision 1.292
retrieving revision 1.293
diff -Lroff.c -Lroff.c -u -p -r1.292 -r1.293
--- roff.c
+++ roff.c
@@ -3092,6 +3092,8 @@ roff_userdef(ROFF_ARGS)
 		else if (++expand_count > EXPAND_LIMIT) {
 			mandoc_msg(MANDOCERR_ROFFLOOP, r->parse,
 			    ln, (int)(cp - n1), NULL);
+			free(buf->buf);
+			buf->buf = n1;
 			return ROFF_IGN;
 		}
 
--
 To unsubscribe send an email to source+unsubscribe@mdocml.bsd.lv