CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/09/04 07:06:08
Modified files:
usr.bin/mandoc : tbl_data.c
Log message:
When a text line in tbl(7) data is completely empty (""),
do not access the byte beyond the terminating NUL byte.
Instead, generate an empty span that contains no data cells,
optionally preceded by a horizontal line if requested by the layout.
This buffer overrun reading exactly one byte too far usually had
no adverse consequences. No matter the value of the wrongfully read
byte, the code would correctly continue after the "if" block,
either (more likely) via failing the p[1] == '\0' condition
or (less likely) via the default branch of the switch.
Theoretically, it might segfault on the one-byte access, though.
Patch from Hippolyte d'Oncieu de la Batie <[email protected]>
who found this bug using clang-14 with libFuzzer and AddressSanitizer.
Reported via espie@.
Clarifying source code comment by me.
