From 7f9cb114fd34b6f74fb89f6b29a4bfd2f7cf921d Mon Sep 17 00:00:00 2001
From: Ingo Schwarze <schwarze@openbsd.org>
Date: Wed, 11 Feb 2015 13:37:57 +0000
Subject: explicit blocks close out .Nd; fixing data structure corruption
 eventually leading to NULL pointer access; found by jsg@ with afl, text case
 #455.

---
 mdoc_macro.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

(limited to 'mdoc_macro.c')

diff --git a/mdoc_macro.c b/mdoc_macro.c
index 579d98b0..5953bd45 100644
--- a/mdoc_macro.c
+++ b/mdoc_macro.c
@@ -1,4 +1,4 @@
-/*	$Id: mdoc_macro.c,v 1.181 2015/02/10 17:47:45 schwarze Exp $ */
+/*	$Id: mdoc_macro.c,v 1.182 2015/02/11 13:37:57 schwarze Exp $ */
 /*
  * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010, 2012-2015 Ingo Schwarze <schwarze@openbsd.org>
@@ -630,6 +630,13 @@ blk_exp_close(MACRO_PROT_ARGS)
 			break;
 		}
 
+		/* Explicit blocks close out description lines. */
+
+		if (n->tok == MDOC_Nd) {
+			rew_last(mdoc, n);
+			continue;
+		}
+
 		/*
 		 * When finding an open sub block, remember the last
 		 * open explicit block, or, in case there are only
-- 
cgit v1.2.3