From: Josiah Frentsos <jfrent@tilde.team>
Subject: mandoc: fix a buffer over-read
To: tech@openbsd.org
Date: Thu, 30 Jul 2026 18:29:57 -0400

To reproduce:

	printf '\\B \\B' | MALLOC_OPTIONS=SU mandoc

Index: roff_escape.c
===================================================================
RCS file: /cvs/src/usr.bin/mandoc/roff_escape.c,v
diff -p -u -r1.15 roff_escape.c
--- roff_escape.c	16 May 2024 21:21:08 -0000	1.15
+++ roff_escape.c	30 Jul 2026 22:12:41 -0000
@@ -297,12 +297,13 @@ roff_escape(const char *buf, const int l
 			if (rval != ESCAPE_EXPAND)
 				rval = ESCAPE_ERROR;
 			if (buf[inam] != 'D') {
-				iendarg = iend = iarg + 1;
+				if (buf[iarg] != '\0')
+					iendarg = iend = iarg + 1;
 				goto out;
 			}
 		}
 		if (term == '\b')
-			term = buf[iarg++];
+			term = buf[iarg] == '\0' ? '\0' : buf[iarg++];
 	} else if (term == '\0' && maxl == INT_MAX) {
 		if (buf[inam] == 'n' && (buf[iarg] == '+' || buf[iarg] == '-'))
 			iarg++;