The .Dd and .TH macros must interrupt .ce, too;

fixing tree corruption and assertion failure found by jsg@ with afl(1)

1 files changed, 2 insertions, 1 deletions

diff --git a/roff.c b/roff.c
index d0cd82f8..1cb12301 100644
--- a/roff.c
+++ b/roff.c
@@ -1559,7 +1559,8 @@ roff_parseln(struct roff *r, int ln, struct buf *buf, int *offs)
 	/* For now, let high level macros abort .ce mode. */
 
 	if (ctl && roffce_node != NULL &&
-	    (t == TOKEN_NONE || t == ROFF_EQ || t == ROFF_TS)) {
+	    (t == TOKEN_NONE || t == ROFF_Dd || t == ROFF_EQ ||
+	     t == ROFF_TH || t == ROFF_TS)) {
 		r->man->last = roffce_node;
 		r->man->next = ROFF_NEXT_SIBLING;
 		roffce_lines = 0;