Fix possible out-of-bounds read for empty escape sequence (i.e. a `\' alone). The single `\' is treated as `\\' and a warning is printed and the exit status raised (like other unknown escape sequences). Index: printf.c =================================================================== RCS file: /cvsroot/src/usr.bin/printf/printf.c,v retrieving revision 1.37 diff -u -p -r1.37 printf.c --- printf.c 16 Jun 2015 22:54:10 -0000 1.37 +++ printf.c 30 Jun 2018 12:27:50 -0000 @@ -469,6 +469,13 @@ conv_escape(char *str, char *conv_ch) case 't': value = '\t'; break; /* tab */ case 'v': value = '\v'; break; /* vertical-tab */ + case '\0': + warnx("empty escape sequence"); + rval = 1; + value = '\\'; + str--; + break; + default: warnx("unknown escape sequence `\\%c'", ch); rval = 1;