Avoid a use after free when the target node is deleted during validation.

Bug reported by jsg@.

1 files changed, 15 insertions, 12 deletions

diff --git a/mdoc_macro.c b/mdoc_macro.c
index f2c7d78e..05234250 100644
--- a/mdoc_macro.c
+++ b/mdoc_macro.c
@@ -291,18 +291,21 @@ rew_pending(struct roff_man *mdoc, const struct roff_node *n)
 	for (;;) {
 		rew_last(mdoc, n);
 
-		switch (n->type) {
-		case ROFFT_HEAD:
-			roff_body_alloc(mdoc, n->line, n->pos, n->tok);
-			return;
-		case ROFFT_BLOCK:
-			break;
-		default:
-			return;
-		}
-
-		if ( ! (n->flags & MDOC_BROKEN))
-			return;
+		if (mdoc->last == n) {
+			switch (n->type) {
+			case ROFFT_HEAD:
+				roff_body_alloc(mdoc, n->line, n->pos,
+				    n->tok);
+				return;
+			case ROFFT_BLOCK:
+				break;
+			default:
+				return;
+			}
+			if ( ! (n->flags & MDOC_BROKEN))
+				return;
+		} else
+			n = mdoc->last;
 
 		for (;;) {
 			if ((n = n->parent) == NULL)