Using user-defined macros, surprisingly, it is possible

to have *next*-line head arguments on the *same* input line.
So .TP must not assume that a head argument with a matching
input line number is a same-line argument (and access a NULL pointer).
Bug found and fix tested by kristaps@ with groff_hdtbl(7).

2 files changed, 5 insertions, 1 deletions

diff --git a/TODO b/TODO
index d1c6ce48..30849d02 100644
--- a/TODO
+++ b/TODO
@@ -350,6 +350,10 @@ Several areas can be cleaned up to make mandoc even faster.  These are
 * structural issues
 ************************************************************************
 
+- We use the input line number at several places to distinguish
+  same-line from different-line input.  That plainly doesn't work
+  with user-defined macros, leading to random breakage.
+
 - Find better ways to prevent endless loops
   in roff(7) macro and string expansion.
  
diff --git a/man_term.c b/man_term.c
index 379a39ab..1d3d663a 100644
--- a/man_term.c
+++ b/man_term.c
@@ -640,7 +640,7 @@ pre_TP(DECL_ARGS)
 	/* Calculate offset. */
 
 	if (NULL != (nn = n->parent->head->child))
-		if (nn->parent->line == nn->line)
+		if (nn->string && nn->parent->line == nn->line)
 			if ((ival = a2width(p, nn->string)) >= 0)
 				len = (size_t)ival;