From f965b0d5670820ab294aa254b0297c5406d982cd Mon Sep 17 00:00:00 2001
From: Ingo Schwarze <schwarze@openbsd.org>
Date: Wed, 10 Aug 2016 12:06:41 +0000
Subject: When validating a .Bl list that defaults to -item for want of a type,
 don't let a subsequent -width access mdoc_argnames[] out of bounds. Found by
 tb@ with afl(1).

---
 mdoc_validate.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mdoc_validate.c b/mdoc_validate.c
index 80ce2080..e6fa51b2 100644
--- a/mdoc_validate.c
+++ b/mdoc_validate.c
@@ -1,4 +1,4 @@
-/*	$Id: mdoc_validate.c,v 1.302 2016/08/09 15:09:27 schwarze Exp $ */
+/*	$Id: mdoc_validate.c,v 1.303 2016/08/10 12:06:41 schwarze Exp $ */
 /*
  * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010-2016 Ingo Schwarze <schwarze@openbsd.org>
@@ -502,6 +502,7 @@ post_bl_norm(POST_ARGS)
 		mandoc_msg(MANDOCERR_BL_NOTYPE, mdoc->parse,
 		    n->line, n->pos, "Bl");
 		n->norm->Bl.type = LIST_item;
+		mdoclt = MDOC_Item;
 	}
 
 	/*
-- 
cgit v1.2.3-56-ge451