Do not mark a block with the MDOC_BROKEN flag if it merely contains

a mismatching explicit end macro without actually being broken.
Avoids a subsequent upward search for the non-existent breaker
ending up in a NULL pointer access; afl test case 005/Apr27 from jsg@.

diff --git a/mdoc_macro.c b/mdoc_macro.c
index 3e5667de5aa325b1b82c5fc1cd4ff75200668a9b..aafb47076135bc630ad4287fe456dbc8c16deb5e 100644 (file)
--- a/mdoc_macro.c
+++ b/mdoc_macro.c
@@ -1,4 +1,4 @@
-/*     $Id: mdoc_macro.c,v 1.195 2015/04/23 15:35:59 schwarze Exp $ */
+/*     $Id: mdoc_macro.c,v 1.196 2015/04/29 14:48:53 schwarze Exp $ */
 /*
  * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010, 2012-2015 Ingo Schwarze <schwarze@openbsd.org>
@@ -644,6 +644,8 @@ blk_exp_close(MACRO_PROT_ARGS)
        if (body == NULL) {
                mandoc_msg(MANDOCERR_BLK_NOTOPEN, mdoc->parse,
                    line, ppos, mdoc_macronames[tok]);
+               if (later != NULL)
+                       later->flags &= ~MDOC_BROKEN;
                if (maxargs && endbody == NULL) {
                        /*
                         * Stray .Ec without previous .Eo: