From 4332dc956a3f583d1ddb558e9b58542659887b7b Mon Sep 17 00:00:00 2001
From: Ingo Schwarze <schwarze@openbsd.org>
Date: Thu, 13 Jul 2017 15:13:18 +0000
Subject: eqn(7) .EQ has to break man(7) next-line scope, or tree corruption
 and use after free many ensue; again found by jsg@ with afl(1)

---
 roff.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/roff.c b/roff.c
index 46f138e0..38595a99 100644
--- a/roff.c
+++ b/roff.c
@@ -1,4 +1,4 @@
-/*	$Id: roff.c,v 1.321 2017/07/08 17:52:50 schwarze Exp $ */
+/*	$Id: roff.c,v 1.322 2017/07/13 15:13:18 schwarze Exp $ */
 /*
  * Copyright (c) 2008-2012, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010-2015, 2017 Ingo Schwarze <schwarze@openbsd.org>
@@ -2879,6 +2879,8 @@ roff_EQ(ROFF_ARGS)
 {
 	struct roff_node	*n;
 
+	if (r->man->macroset == MACROSET_MAN)
+		man_breakscope(r->man, ROFF_EQ);
 	n = roff_node_alloc(r->man, ln, ppos, ROFFT_EQN, TOKEN_NONE);
 	if (ln > r->man->last->line)
 		n->flags |= NODE_LINE;
-- 
cgit v1.2.3-56-ge451