9fans / plan9port

Plan 9 from User Space
https://9fans.github.io/plan9port/
Other
1.64k stars 326 forks source link

deroff: fix out-of-bounds access if runes above 0X80 are inside EQ clauses #435

Closed mmnmnnmnmm closed 2 years ago

mmnmnnmnmm commented 4 years ago

Characters greater than 0X80 will cause a read beyond the bounds of the array chars[]. For particular unicode characters this can cause deroff to segfault.

A minimal example: $ deroff .EQ u∈ Segmentation fault

Throughout deroff, charclass() is used instead of directly indexing chars[] so I presume this was just missed.