If a .Bd display is on the one hand doomed to be deleted because

it has no type, but is on the other hand breaking another block,
delete its end marker as well, or the end marker may remain behind
as an orphan, triggering an assertion in the terminal formatter.
Problem found by tb@ with afl(1).

diff --git a/mdoc_validate.c b/mdoc_validate.c
index 832832fbc9a4dc2ba5d318b662f9c99838bed114..bc8b93bfc4e1a55622a04380d764964fa18f11e7 100644 (file)
--- a/mdoc_validate.c
+++ b/mdoc_validate.c
@@ -1,4 +1,4 @@
-/*     $Id: mdoc_validate.c,v 1.305 2016/08/10 20:17:50 schwarze Exp $ */
+/*     $Id: mdoc_validate.c,v 1.306 2016/08/11 10:47:16 schwarze Exp $ */

 /*
  * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010-2016 Ingo Schwarze <schwarze@openbsd.org>
 /*
  * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010-2016 Ingo Schwarze <schwarze@openbsd.org>


@@ -886,9 +886,10 @@ post_display(POST_ARGS)
        n = mdoc->last;
        switch (n->type) {
        case ROFFT_BODY:
        n = mdoc->last;
        switch (n->type) {
        case ROFFT_BODY:

-               if (n->end != ENDBODY_NOT)
-                       break;
-               if (n->child == NULL)
+               if (n->end != ENDBODY_NOT) {
+                       if (n->tok == MDOC_Bd && n->parent->args == NULL)
+                               roff_node_delete(mdoc, n);
+               } else if (n->child == NULL)

                        mandoc_msg(MANDOCERR_BLK_EMPTY, mdoc->parse,
                            n->line, n->pos, mdoc_macronames[n->tok]);
                else if (n->tok == MDOC_D1)
                        mandoc_msg(MANDOCERR_BLK_EMPTY, mdoc->parse,
                            n->line, n->pos, mdoc_macronames[n->tok]);
                else if (n->tok == MDOC_D1)