When the last line of a table layout turns out to be empty, it is deleted.

Do not just free the struct tbl_row but also make sure that no pointer
to it remains.  Fixing a use after free found by jsg@ with afl.

1 files changed, 1 insertions, 0 deletions

diff --git a/tbl_layout.c b/tbl_layout.c
index 48a654cc..1bfcee1b 100644
--- a/tbl_layout.c
+++ b/tbl_layout.c
@@ -308,6 +308,7 @@ tbl_layout(struct tbl_node *tbl, int ln, const char *p, int pos)
 				    rp->next->first == NULL) {
 					free(rp->next);
 					rp->next = NULL;
+					tbl->last_row = rp;
 				}
 			}
 			return;