Do not prematurely close .Nd containing a broken child.

Fixes tree corruption leading to NULL dereference
in insane cases like .Oo Oo .Nd .Pq Oc .Oc Oc
found by tb@ with afl(1).

diff --git a/NEWS b/NEWS
index d2084a215f7860ceebd8af61e268309c1ea461f4..5df3da51c84f39c47314aa8bbcf0c1b0242f5c1b 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,4 +1,4 @@
-$Id: NEWS,v 1.16 2017/02/10 16:20:34 schwarze Exp $
+$Id: NEWS,v 1.17 2017/02/11 14:11:17 schwarze Exp $
 
 This file lists the most important changes in the mdocml.bsd.lv distribution.
 
@@ -53,8 +53,10 @@ Changes in version 1.14.1, released on February XXX, 2017
  * mdoc(7): Fix syntax tree corruption leading to NULL dereference
    caused by .Ta following a nested .Bl -column breaking another block.
  * mdoc(7): Fix syntax tree corruption sometimes leading to NULL
-   dereference caused by indirectly broken .Nm blocks in the SYNOPSIS.
+   dereference caused by indirectly broken .Nd or .Nm blocks.
  * mdoc(7) -Thtml: Fix a NULL dereference for .Bl -column with 0 columns.
+ * mdoc(7): Fix NULL dereference in some specific cases of a
+   block-end macro calling another block-end macro.
  * mdoc(7): Fix NULL dereference if the only child of the head
    of the first .Sh was an empty in-line macro.
  * mdoc(7): Fix an assertion failure for a .Bd without a type that

diff --git a/mdoc_macro.c b/mdoc_macro.c
index 3326add65b82d4d890047433e9a108d8c32d9b73..a1cea0ef3c030302a176362d7e28bcc22846a089 100644 (file)
--- a/mdoc_macro.c
+++ b/mdoc_macro.c
@@ -1,4 +1,4 @@
-/*     $Id: mdoc_macro.c,v 1.213 2017/02/11 13:24:12 schwarze Exp $ */
+/*     $Id: mdoc_macro.c,v 1.214 2017/02/11 14:11:17 schwarze Exp $ */
 /*
  * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010, 2012-2016 Ingo Schwarze <schwarze@openbsd.org>
@@ -647,10 +647,16 @@ blk_exp_close(MACRO_PROT_ARGS)
                        break;
                }
 
-               /* Explicit blocks close out description lines. */
+               /*
+                * Explicit blocks close out description lines, but
+                * even those can get broken together with a child.
+                */
 
                if (n->tok == MDOC_Nd) {
-                       rew_last(mdoc, n);
+                       if (later != NULL)
+                               n->flags |= NODE_BROKEN | NODE_ENDED;
+                       else
+                               rew_last(mdoc, n);
                        continue;
                }