diff options
| author | Ingo Schwarze <schwarze@openbsd.org> | 2016-08-11 13:30:25 +0000 |
|---|---|---|
| committer | Ingo Schwarze <schwarze@openbsd.org> | 2016-08-11 13:30:25 +0000 |
| commit | a6e2b9125ac019234a478e300d9a516867a7bf26 (patch) | |
| tree | 1cd61e5e3daaeaf9fcdef672cf5e79f114757436 /mdoc_macro.c | |
| parent | 16d253a28afb75128b49ce68e8fba02526bba4fd (diff) | |
| download | mandoc-a6e2b9125ac019234a478e300d9a516867a7bf26.tar.gz | |
Even after switching from a pending head to the body, we have to
continue scanning upwards, because the enclosing block might already
be pending as well, e.g. .Bl .Bl .It Bo .El .It.
Tree corruption leading to a later NULL deref found by tb@ with afl(1).
Diffstat (limited to 'mdoc_macro.c')
| -rw-r--r-- | mdoc_macro.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/mdoc_macro.c b/mdoc_macro.c index 5aaab629..c5bd45ee 100644 --- a/mdoc_macro.c +++ b/mdoc_macro.c @@ -292,7 +292,7 @@ rew_pending(struct roff_man *mdoc, const struct roff_node *n) case ROFFT_HEAD: roff_body_alloc(mdoc, n->line, n->pos, n->tok); - return; + break; case ROFFT_BLOCK: break; default: |