Fix blunder in previous: we must keep the line parse buffer

consistent even when aborting the parsing of the line.  That buffer
is not our own, but owned and reused by mparse_buf_r(), read.c.
Returning without cleanup leaked memory and caused write overruns
of the old, typically much smaller buffer in mparse_buf_r().
Promptly noticed by tb@ with afl(1), using MALLOC_OPTIONS=C.

1 files changed, 2 insertions, 0 deletions

diff --git a/roff.c b/roff.c
index 54bebf78..5db7f4e7 100644
--- a/roff.c
+++ b/roff.c
@@ -3092,6 +3092,8 @@ roff_userdef(ROFF_ARGS)
 		else if (++expand_count > EXPAND_LIMIT) {
 			mandoc_msg(MANDOCERR_ROFFLOOP, r->parse,
 			    ln, (int)(cp - n1), NULL);
+			free(buf->buf);
+			buf->buf = n1;
 			return ROFF_IGN;
 		}