* mdocml: improve previous: do the size check up front to avoid leaking
@ 2014-12-28 14:16 schwarze
0 siblings, 0 replies; only message in thread
From: schwarze @ 2014-12-28 14:16 UTC (permalink / raw)
To: source
Log Message:
-----------
improve previous: do the size check up front to avoid leaking memory
Modified Files:
--------------
mdocml:
roff.c
Revision Data
-------------
Index: roff.c
===================================================================
RCS file: /home/cvs/mdocml/mdocml/roff.c,v
retrieving revision 1.245
retrieving revision 1.246
diff -Lroff.c -Lroff.c -u -p -r1.245 -r1.246
--- roff.c
+++ roff.c
@@ -651,6 +651,10 @@ roff_res(struct roff *r, struct buf *buf
r->parse, ln, (int)(stesc - buf->buf),
"%.*s", (int)naml, stnam);
res = "";
+ } else if (buf->sz + strlen(res) > SHRT_MAX) {
+ mandoc_msg(MANDOCERR_ROFFLOOP, r->parse,
+ ln, (int)(stesc - buf->buf), NULL);
+ return(ROFF_IGN);
}
/* Replace the escape sequence by the string. */
@@ -658,12 +662,6 @@ roff_res(struct roff *r, struct buf *buf
*stesc = '\0';
buf->sz = mandoc_asprintf(&nbuf, "%s%s%s",
buf->buf, res, cp) + 1;
-
- if (buf->sz > SHRT_MAX) {
- mandoc_msg(MANDOCERR_ROFFLOOP, r->parse,
- ln, (int)(stesc - buf->buf), NULL);
- return(ROFF_IGN);
- }
/* Prepare for the next replacement. */
--
To unsubscribe send an email to source+unsubscribe@mdocml.bsd.lv
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2014-12-28 14:16 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-12-28 14:16 mdocml: improve previous: do the size check up front to avoid leaking schwarze
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).