===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/deroff/deroff.c,v
retrieving revision 1.8
retrieving revision 1.9
diff -c -r1.8 -r1.9
*** src/usr.bin/deroff/deroff.c	2009/10/27 23:59:37	1.8
--- src/usr.bin/deroff/deroff.c	2014/12/03 16:44:55	1.9
***************
*** 1,4 ****
! /*	$OpenBSD: deroff.c,v 1.8 2009/10/27 23:59:37 deraadt Exp $	*/
  
  /*-
   * Copyright (c) 1988, 1993
--- 1,4 ----
! /*	$OpenBSD: deroff.c,v 1.9 2014/12/03 16:44:55 millert Exp $	*/
  
  /*-
   * Copyright (c) 1988, 1993
***************
*** 745,754 ****
  inpic(void)
  {
  	int c1;
! 	char *p1;
  
  	SKIP;
  	p1 = line;
  	c = '\n';
  	for (;;) {
  		c1 = c;
--- 745,755 ----
  inpic(void)
  {
  	int c1;
! 	char *p1, *ep;
  
  	SKIP;
  	p1 = line;
+ 	ep = line + sizeof(line) - 1;
  	c = '\n';
  	for (;;) {
  		c1 = c;
***************
*** 781,788 ****
  						continue;
  					ungetc(c, infile);
  					backsl();
! 				} else
  					*p1++ = c;
  			}
  			*p1++ = ' ';
  		}
--- 782,792 ----
  						continue;
  					ungetc(c, infile);
  					backsl();
! 				} else if (p1 + 1 >= ep) {
! 					errx(1, ".PS length exceeds limit");
! 				} else {
  					*p1++ = c;
+ 				}
  			}
  			*p1++ = ' ';
  		}