=================================================================== RCS file: /cvs/mandoc/roff.c,v retrieving revision 1.289 retrieving revision 1.293 diff -u -p -r1.289 -r1.293 --- mandoc/roff.c 2017/02/17 03:03:03 1.289 +++ mandoc/roff.c 2017/03/09 15:29:35 1.293 @@ -1,4 +1,4 @@ -/* $Id: roff.c,v 1.289 2017/02/17 03:03:03 schwarze Exp $ */ +/* $Id: roff.c,v 1.293 2017/03/09 15:29:35 schwarze Exp $ */ /* * Copyright (c) 2008-2012, 2014 Kristaps Dzonsons * Copyright (c) 2010-2015, 2017 Ingo Schwarze @@ -1236,7 +1236,7 @@ deroff(char **dest, const struct roff_node *n) /* Skip trailing backslash. */ sz = strlen(cp); - if (cp[sz - 1] == '\\') + if (sz > 0 && cp[sz - 1] == '\\') sz--; /* Skip trailing whitespace. */ @@ -1608,7 +1608,7 @@ roff_parseln(struct roff *r, int ln, struct buf *buf, return ROFF_IGN; while (buf->buf[pos] != '\0' && buf->buf[pos] != ' ') pos++; - while (buf->buf[pos] != '\0' && buf->buf[pos] == ' ') + while (buf->buf[pos] == ' ') pos++; return tbl_read(r->tbl, ln, buf->buf, pos); } @@ -3038,7 +3038,7 @@ roff_userdef(ROFF_ARGS) { const char *arg[9], *ap; char *cp, *n1, *n2; - int i, ib, ie; + int expand_count, i, ib, ie; size_t asz, rsz; /* @@ -3062,8 +3062,9 @@ roff_userdef(ROFF_ARGS) */ buf->sz = strlen(r->current_string) + 1; - n1 = cp = mandoc_malloc(buf->sz); + n1 = n2 = cp = mandoc_malloc(buf->sz); memcpy(n1, r->current_string, buf->sz); + expand_count = 0; while (*cp != '\0') { /* Scan ahead for the next argument invocation. */ @@ -3081,6 +3082,20 @@ roff_userdef(ROFF_ARGS) continue; } cp -= 2; + + /* + * Prevent infinite recursion. + */ + + if (cp >= n2) + expand_count = 1; + else if (++expand_count > EXPAND_LIMIT) { + mandoc_msg(MANDOCERR_ROFFLOOP, r->parse, + ln, (int)(cp - n1), NULL); + free(buf->buf); + buf->buf = n1; + return ROFF_IGN; + } /* * Determine the size of the expanded argument,