mdocml: When a numerical condition errors out after consuming at least

mdocml: When a numerical condition errors out after consuming at least

[schwarze]

Log Message:
-----------
When a numerical condition errors out after consuming at least one
character of input, treat it as false, do not retry it as a string 
comparison condition.  This also fixes a read buffer overrun that  
happened when the numerical condition advanced to the end of the 
input line before erroring out, found by jsg@ with afl.

Modified Files:
--------------
    mdocml:
        roff.c

Revision Data
-------------
Index: roff.c
===================================================================
RCS file: /home/cvs/mdocml/mdocml/roff.c,v
retrieving revision 1.240
retrieving revision 1.241
diff -Lroff.c -Lroff.c -u -p -r1.240 -r1.241
--- roff.c
+++ roff.c
@@ -1249,7 +1249,7 @@ out:
 static int
 roff_evalcond(struct roff *r, int ln, const char *v, int *pos)
 {
-	int	 wanttrue, number;
+	int	 number, savepos, wanttrue;
 
 	if ('!' == v[*pos]) {
 		wanttrue = 0;
@@ -1282,10 +1282,13 @@ roff_evalcond(struct roff *r, int ln, co
 		break;
 	}
 
+	savepos = *pos;
 	if (roff_evalnum(r, ln, v, pos, &number, 0))
 		return((number > 0) == wanttrue);
-	else
+	else if (*pos == savepos)
 		return(roff_evalstrcond(v, pos) == wanttrue);
+	else
+		return (0);
 }
 
 static enum rofferr
--
 To unsubscribe send an email to source+unsubscribe@mdocml.bsd.lv