shithub: riscv

Info  •  Files  •  Log  •  Branches

htmlroff: fix out of bounds access (thanks Rei-sen, via plan9port)

_readx() uses rune count as its argument and not size, so we should
pass nelem() instead of sizeof().

--- a/sys/src/cmd/htmlroff/roff.c

+++ b/sys/src/cmd/htmlroff/roff.c

@@ -257,7 +257,7 @@

 	int c;

 	Rune *r;

-	if(_readx(buf, sizeof buf, ArgMode, 0) < 0)

+	if(_readx(buf, nelem(buf), ArgMode, 0) < 0)

 		return nil;

 	r = runestrstr(buf, L("\\\""));

 	if(r){

@@ -280,7 +280,7 @@

 	static Rune buf[MaxLine];

 	Rune *r;

-	if(_readx(buf, sizeof buf, m, 1) < 0)

+	if(_readx(buf, nelem(buf), m, 1) < 0)

 		return nil;

 	r = erunestrdup(buf);

 	return r;