Don't deref NULL if the only child of the first .Sh is an empty

in-line macro, and don't printf("%s", NULL) if the first child
of the first .Sh is a macro; again found by tb@ with afl(1).
(No, you should never use macros in any .Sh at all, please.)

diff --git a/mdoc_validate.c b/mdoc_validate.c
index 214e98da7ceaa0d3993637aa4360b79e3f5c3110..832832fbc9a4dc2ba5d318b662f9c99838bed114 100644 (file)
--- a/mdoc_validate.c
+++ b/mdoc_validate.c
@@ -1,4 +1,4 @@
-/*     $Id: mdoc_validate.c,v 1.304 2016/08/10 12:29:38 schwarze Exp $ */
+/*     $Id: mdoc_validate.c,v 1.305 2016/08/10 20:17:50 schwarze Exp $ */
 /*
  * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010-2016 Ingo Schwarze <schwarze@openbsd.org>
@@ -1761,8 +1761,9 @@ post_sh_authors(POST_ARGS)
 static void
 post_sh_head(POST_ARGS)
 {
-       const char      *goodsec;
-       enum roff_sec    sec;
+       struct roff_node        *nch;
+       const char              *goodsec;
+       enum roff_sec            sec;
 
        /*
         * Process a new section.  Sections are either "named" or
@@ -1778,8 +1779,10 @@ post_sh_head(POST_ARGS)
        if (sec != SEC_NAME && mdoc->lastnamed == SEC_NONE)
                mandoc_vmsg(MANDOCERR_NAMESEC_FIRST, mdoc->parse,
                    mdoc->last->line, mdoc->last->pos, "Sh %s",
-                   sec == SEC_CUSTOM ? mdoc->last->child->string :
-                   secnames[sec]);
+                   sec != SEC_CUSTOM ? secnames[sec] :
+                   (nch = mdoc->last->child) == NULL ? "" :
+                   nch->type == ROFFT_TEXT ? nch->string :
+                   mdoc_macronames[nch->tok]);
 
        /* The SYNOPSIS gets special attention in other areas. */