explicit blocks close out .Nd; fixing data structure corruption

eventually leading to NULL pointer access;
found by jsg@ with afl, text case #455.

diff --git a/mdoc_macro.c b/mdoc_macro.c
index 579d98b035810da498d063f9b376f8f19ff383bf..5953bd453c9fd7863a3a5e36519ca9f3086a34c3 100644 (file)
--- a/mdoc_macro.c
+++ b/mdoc_macro.c
@@ -1,4 +1,4 @@
-/*     $Id: mdoc_macro.c,v 1.181 2015/02/10 17:47:45 schwarze Exp $ */
+/*     $Id: mdoc_macro.c,v 1.182 2015/02/11 13:37:57 schwarze Exp $ */

 /*
  * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010, 2012-2015 Ingo Schwarze <schwarze@openbsd.org>
 /*
  * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010, 2012-2015 Ingo Schwarze <schwarze@openbsd.org>


@@ -630,6 +630,13 @@ blk_exp_close(MACRO_PROT_ARGS)
                        break;
                }
 
                        break;
                }
 

+               /* Explicit blocks close out description lines. */
+
+               if (n->tok == MDOC_Nd) {
+                       rew_last(mdoc, n);
+                       continue;
+               }
+

                /*
                 * When finding an open sub block, remember the last
                 * open explicit block, or, in case there are only
                /*
                 * When finding an open sub block, remember the last
                 * open explicit block, or, in case there are only