diff options
| author | Ori Bernstein <ori@eigenstate.org> | 2020-08-01 10:54:03 -0700 |
|---|---|---|
| committer | Ori Bernstein <ori@eigenstate.org> | 2020-08-01 10:54:03 -0700 |
| commit | 9e27ee094c25873c71da6488d7926c621c115c68 (patch) | |
| tree | d6d9a4b56654ef85a054cd1f8dcb62073fba192c /sys/src/cmd/deroff.c | |
| parent | 6dbecfb457d1625687f2338696c2b8195c831ae4 (diff) | |
deroff: fix out-of-bounds access if runes above 0X80 are inside EQ clauses (thanks mmnmnnmnmm, via plan9port)
Characters greater than 0X80 will cause a read beyond the bounds of the
array chars[]. For particular unicode characters this can cause deroff
to segfault.
A minimal example:
$ deroff
.EQ
u∈
Segmentation fault
Throughout deroff, charclass() is used instead of directly indexing
chars[] so I presume this was just missed.
Diffstat (limited to 'sys/src/cmd/deroff.c')
| -rw-r--r-- | sys/src/cmd/deroff.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/src/cmd/deroff.c b/sys/src/cmd/deroff.c index 914c5a3f5..ce0cee95b 100644 --- a/sys/src/cmd/deroff.c +++ b/sys/src/cmd/deroff.c @@ -745,7 +745,7 @@ eqn(void) } if(c != '\n') while(C1 != '\n') { - if(chars[c] == PUNCT) + if(charclass(c) == PUNCT) last = c; else if(c != ' ') |