Fix a crash triggered by .Bl -tag .It Xo .El .Sh found by florian@.

* When allocating a body end marker, copy the pointer to the normalized
block information from the body block, avoiding the risk of subsequent
null pointer derefence.
* When inserting the body end marker into the syntax tree, do not try to
copy that pointer from the parent block, because not being a direkt child
of the block it belongs to is the whole point of a body end marker.
* Even non-callable blocks (like Bd and Bl) can break other blocks;
when this happens, postpone closing them out in the usual way.

Completed and tested at the OpenBSD impromptu Coimbra hackathon (c2k12).
Thanks to Pedro Almeida and the Laborat'orio de Computa,c~ao Avan,cada
da Universidade de Coimbra (http://www.uc.pt/lca) for their hospitality!

2 files changed, 4 insertions, 1 deletions

diff --git a/mdoc.c b/mdoc.c
index 01a0d2a6..87f513c0 100644
--- a/mdoc.c
+++ b/mdoc.c
@@ -375,6 +375,8 @@ node_append(struct mdoc *mdoc, struct mdoc_node *p)
 
 	switch (p->type) {
 	case (MDOC_BODY):
+		if (ENDBODY_NOT != p->end)
+			break;
 		/* FALLTHROUGH */
 	case (MDOC_TAIL):
 		/* FALLTHROUGH */
@@ -501,6 +503,7 @@ mdoc_endbody_alloc(struct mdoc *m, int line, int pos, enum mdoct tok,
 
 	p = node_alloc(m, line, pos, tok, MDOC_BODY);
 	p->pending = body;
+	p->norm = body->norm;
 	p->end = end;
 	if ( ! node_append(m, p))
 		return(0);
diff --git a/mdoc_macro.c b/mdoc_macro.c
index 3e5d46af..29c6cff0 100644
--- a/mdoc_macro.c
+++ b/mdoc_macro.c
@@ -738,7 +738,7 @@ blk_exp_close(MACRO_PROT_ARGS)
 		if (later &&
 		    MDOC_EXPLICIT & mdoc_macros[later->tok].flags)
 			continue;
-		if (MDOC_CALLABLE & mdoc_macros[n->tok].flags)
+		if (MDOC_It != n->tok)
 			later = n;
 	}