Delete the redundant tbl span flags, just inspect the actual data

where needed, which is less fragile.
This fixes a subtle NULL pointer access to tp->tbl.cols:
Due to a bug in the man(7) parser, the first span of a table can
end up in a .TP head, in which case tblcalc() was never called.
Found by jsg@ with afl.

1 files changed, 1 insertions, 4 deletions

diff --git a/mandoc.h b/mandoc.h
index 42eb858d..01dbafa6 100644
--- a/mandoc.h
+++ b/mandoc.h
@@ -1,4 +1,4 @@
-/*	$Id: mandoc.h,v 1.193 2015/01/30 04:11:50 schwarze Exp $ */
+/*	$Id: mandoc.h,v 1.194 2015/01/30 17:32:16 schwarze Exp $ */
 /*
  * Copyright (c) 2010, 2011, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010-2015 Ingo Schwarze <schwarze@openbsd.org>
@@ -285,9 +285,6 @@ struct	tbl_span {
 	struct tbl_span	 *prev;
 	struct tbl_span	 *next;
 	int		  line; /* parse line */
-	int		  flags;
-#define	TBL_SPAN_FIRST	 (1 << 0)
-#define	TBL_SPAN_LAST	 (1 << 1)
 	enum tbl_spant	  pos;
 };