Fix possible out-of-bounds read for empty escape sequence (i.e. a `\' alone). The single `\' is treated as `\\' and a warning is printed and the exit status raised (like other unknown escape sequences). Index: printf.c =================================================================== RCS file: /cvsroot/src/usr.bin/printf/printf.c,v retrieving revision 1.37 diff -u -p -r1.37 printf.c --- printf.c 16 Jun 2015 22:54:10 -0000 1.37 +++ printf.c 2 Jul 2018 14:35:45 -0000 @@ -430,6 +430,14 @@ conv_escape(char *str, char *conv_ch) char ch; char num_buf[4], *num_end; + if (*str == '\0') { + warnx("incomplete escape sequence"); + rval = 1; + value = '\\'; + *conv_ch = value; + return str; + } + ch = *str++; switch (ch) {