Element next-line scopes can nest. Consequently, even when closing

one element next-line scope, the MAN_ELINE flag must not yet be
cleared if the parent macro is another element macro having next-line
scope, or an assertion failure is caused if all this is wrapped in
another macro that has block next-line scope, for example .TP.
Bug found in an afl run performed by Jan Schreiber <jes at posteo dot de>.

6 files changed, 41 insertions, 15 deletions

diff --git a/man_macro.c b/man_macro.c
index d195576d..b3c3a3cb 100644
--- a/man_macro.c
+++ b/man_macro.c
@@ -1,7 +1,7 @@
-/*	$Id: man_macro.c,v 1.144 2019/01/05 18:59:46 schwarze Exp $ */
+/* $Id: man_macro.c,v 1.145 2020/09/09 17:01:10 schwarze Exp $ */
 /*
  * Copyright (c) 2008, 2009, 2010, 2011 Kristaps Dzonsons <kristaps@bsd.lv>
- * Copyright (c) 2012-2015, 2017-2019 Ingo Schwarze <schwarze@openbsd.org>
+ * Copyright (c) 2012-2015, 2017-2020 Ingo Schwarze <schwarze@openbsd.org>
  * Copyright (c) 2013 Franco Fichtner <franco@lastsummer.de>
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -107,9 +107,11 @@ man_unscope(struct roff_man *man, const struct roff_node *to)
 				mandoc_msg(MANDOCERR_BLK_LINE,
 				    n->line, n->pos,
 				    "EOF breaks %s", roff_name[n->tok]);
-				if (man->flags & MAN_ELINE)
-					man->flags &= ~MAN_ELINE;
-				else {
+				if (man->flags & MAN_ELINE) {
+					if ((man_macro(n->parent->tok)->flags &
+					    MAN_ESCOPED) == 0)
+						man->flags &= ~MAN_ELINE;
+				} else {
 					assert(n->type == ROFFT_HEAD);
 					n = n->parent;
 					man->flags &= ~MAN_BLINE;
diff --git a/regress/man/TP/broken.in b/regress/man/TP/broken.in
index 686b5559..b0813432 100644
--- a/regress/man/TP/broken.in
+++ b/regress/man/TP/broken.in
@@ -1,7 +1,7 @@
-.\" $OpenBSD: broken.in,v 1.3 2017/07/04 14:53:24 schwarze Exp $
-.TH TP-BROKEN 1 "December 16, 2014"
+.\" $OpenBSD: broken.in,v 1.4 2020/09/09 16:57:05 schwarze Exp $
+.TH TP-BROKEN 1 "September 9, 2020"
 .SH NAME
-TP-broken \- broken tagged paragraph
+TP-broken \- broken tagged paragraphs
 .SH DESCRIPTION
 regular
 text
@@ -16,3 +16,6 @@ text
 
 head
 body
+.TP
+.B
+.I
diff --git a/regress/man/TP/broken.out_ascii b/regress/man/TP/broken.out_ascii
index 68fab4f0..0e817a9c 100644
--- a/regress/man/TP/broken.out_ascii
+++ b/regress/man/TP/broken.out_ascii
@@ -3,7 +3,7 @@ TP-BROKEN(1)                General Commands Manual               TP-BROKEN(1)
 
 
 NNAAMMEE
-       TP-broken - broken tagged paragraph
+       TP-broken - broken tagged paragraphs
 
 DDEESSCCRRIIPPTTIIOONN
        regular text
@@ -14,4 +14,4 @@ DDEESSCCRRIIPPTTIIOONN
 
 
 
-OpenBSD                        December 16, 2014                  TP-BROKEN(1)
+OpenBSD                        September 9, 2020                  TP-BROKEN(1)
diff --git a/regress/man/TP/broken.out_lint b/regress/man/TP/broken.out_lint
index 2539a622..a0b83e81 100644
--- a/regress/man/TP/broken.out_lint
+++ b/regress/man/TP/broken.out_lint
@@ -1,2 +1,5 @@
 mandoc: broken.in:11:2: WARNING: line scope broken: RE breaks TP
 mandoc: broken.in:16:1: WARNING: skipping blank line in line scope
+mandoc: broken.in:21:2: WARNING: line scope broken: EOF breaks I
+mandoc: broken.in:20:2: WARNING: line scope broken: EOF breaks B
+mandoc: broken.in:19:2: WARNING: line scope broken: EOF breaks TP
diff --git a/regress/man/TP/macrotag.in b/regress/man/TP/macrotag.in
index ec214f41..4f6d8029 100644
--- a/regress/man/TP/macrotag.in
+++ b/regress/man/TP/macrotag.in
@@ -1,7 +1,7 @@
-.\" $OpenBSD: macrotag.in,v 1.3 2017/07/04 14:53:24 schwarze Exp $
-.TH TP-MACROTAG 1 "September 20, 2011"
+.\" $OpenBSD: macrotag.in,v 1.4 2020/09/09 16:57:05 schwarze Exp $
+.TH TP-MACROTAG 1 "September 9, 2020"
 .SH NAME
-TP-macrotag \- macro in the head of a tagged paragraph
+TP-macrotag \- macros in the head of tagged paragraphs
 .SH DESCRIPTION
 regular
 text
@@ -9,6 +9,18 @@ text
 .B longindent
 indented
 text
+.TP
+.B
+.I
+next-line
+indented
+text
+.TP
+.B
+.SM
+bold small
+indented
+text
 .PP
 regular
 text
diff --git a/regress/man/TP/macrotag.out_ascii b/regress/man/TP/macrotag.out_ascii
index e466adcf..97b604a8 100644
--- a/regress/man/TP/macrotag.out_ascii
+++ b/regress/man/TP/macrotag.out_ascii
@@ -3,7 +3,7 @@ TP-MACROTAG(1)              General Commands Manual             TP-MACROTAG(1)
 
 
 NNAAMMEE
-       TP-macrotag - macro in the head of a tagged paragraph
+       TP-macrotag - macros in the head of tagged paragraphs
 
 DDEESSCCRRIIPPTTIIOONN
        regular text
@@ -11,8 +11,14 @@ DDEESSCCRRIIPPTTIIOONN
        lloonnggiinnddeenntt
               indented text
 
+       _n_e_x_t_-_l_i_n_e
+              indented text
+
+       bboolldd ssmmaallll
+              indented text
+
        regular text
 
 
 
-OpenBSD                       September 20, 2011                TP-MACROTAG(1)
+OpenBSD                        September 9, 2020                TP-MACROTAG(1)