do not access a NULL pointer if an .Eo block lacks a tail;

found by jsg@ with afl, test case #16

7 files changed, 36 insertions, 15 deletions

diff --git a/regress/usr.bin/mandoc/mdoc/Eo/Makefile b/regress/usr.bin/mandoc/mdoc/Eo/Makefile
index 73a8f5f41ba..0034e271182 100644
--- a/regress/usr.bin/mandoc/mdoc/Eo/Makefile
+++ b/regress/usr.bin/mandoc/mdoc/Eo/Makefile
@@ -1,6 +1,11 @@
-# $OpenBSD: Makefile,v 1.3 2014/11/27 22:27:40 schwarze Exp $
+# $OpenBSD: Makefile,v 1.4 2015/02/11 14:14:53 schwarze Exp $
 
-REGRESS_TARGETS	= break empty obsolete
-LINT_TARGETS	= break obsolete
+REGRESS_TARGETS	 = break empty obsolete unclosed
+LINT_TARGETS	 = break obsolete unclosed
+
+# groff-1.22.3 defect:
+# - When .Ec is missing, groff prints no page footer.
+
+SKIP_GROFF	 = unclosed
 
 .include <bsd.regress.mk>
diff --git a/regress/usr.bin/mandoc/mdoc/Eo/unclosed.in b/regress/usr.bin/mandoc/mdoc/Eo/unclosed.in
new file mode 100644
index 00000000000..59b6d527b5e
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/Eo/unclosed.in
@@ -0,0 +1,9 @@
+.Dd February 11, 2015
+.Dt EO-UNCLOSED 1
+.Os OpenBSD
+.Sh NAME
+.Nm Eo-unclosed
+.Nd unclosed custom enclosure block
+.Sh DESCRIPTION
+before block
+.Eo <<
diff --git a/regress/usr.bin/mandoc/mdoc/Eo/unclosed.out_ascii b/regress/usr.bin/mandoc/mdoc/Eo/unclosed.out_ascii
new file mode 100644
index 00000000000..0d32206fad4
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/Eo/unclosed.out_ascii
@@ -0,0 +1,9 @@
+EO-UNCLOSED(1)              General Commands Manual             EO-UNCLOSED(1)
+
+NNAAMMEE
+     EEoo--uunncclloosseedd - unclosed custom enclosure block
+
+DDEESSCCRRIIPPTTIIOONN
+     before block <<
+
+OpenBSD                        February 11, 2015                       OpenBSD
diff --git a/regress/usr.bin/mandoc/mdoc/Eo/unclosed.out_lint b/regress/usr.bin/mandoc/mdoc/Eo/unclosed.out_lint
new file mode 100644
index 00000000000..49dae22ecda
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/Eo/unclosed.out_lint
@@ -0,0 +1 @@
+mandoc: unclosed.in:9:2: ERROR: appending missing end of block: Eo
diff --git a/usr.bin/mandoc/mdoc_html.c b/usr.bin/mandoc/mdoc_html.c
index 80575e0b236..339eb9917e4 100644
--- a/usr.bin/mandoc/mdoc_html.c
+++ b/usr.bin/mandoc/mdoc_html.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mdoc_html.c,v 1.98 2015/02/05 01:46:38 schwarze Exp $ */
+/*	$OpenBSD: mdoc_html.c,v 1.99 2015/02/11 14:14:53 schwarze Exp $ */
 /*
  * Copyright (c) 2008-2011, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2014, 2015 Ingo Schwarze <schwarze@openbsd.org>
@@ -2218,9 +2218,8 @@ mdoc_eo_pre(MDOC_ARGS)
 	    n->child->end != ENDBODY_NOT)
 		print_text(h, "\\&");
 	else if (n->end != ENDBODY_NOT ? n->child != NULL :
-	    n->parent->head->child != NULL &&
-	    (n->parent->body->child != NULL ||
-	     n->parent->tail->child != NULL))
+	    n->parent->head->child != NULL && (n->child != NULL ||
+	    (n->parent->tail != NULL && n->parent->tail->child != NULL)))
 		h->flags |= HTML_NOSPACE;
 	return(1);
 }
diff --git a/usr.bin/mandoc/mdoc_man.c b/usr.bin/mandoc/mdoc_man.c
index 07553485220..906b99fdbac 100644
--- a/usr.bin/mandoc/mdoc_man.c
+++ b/usr.bin/mandoc/mdoc_man.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mdoc_man.c,v 1.83 2015/02/06 03:31:11 schwarze Exp $ */
+/*	$OpenBSD: mdoc_man.c,v 1.84 2015/02/11 14:14:53 schwarze Exp $ */
 /*
  * Copyright (c) 2011-2015 Ingo Schwarze <schwarze@openbsd.org>
  *
@@ -1138,9 +1138,8 @@ pre_eo(DECL_ARGS)
 	    n->child->end != ENDBODY_NOT)
 		print_word("\\&");
 	else if (n->end != ENDBODY_NOT ? n->child != NULL :
-	    n->parent->head->child != NULL &&
-	    (n->parent->body->child != NULL ||
-	     n->parent->tail->child != NULL))
+	    n->parent->head->child != NULL && (n->child != NULL ||
+	    (n->parent->tail != NULL && n->parent->tail->child != NULL)))
 		outflags &= ~(MMAN_spc | MMAN_nl);
 	return(1);
 }
diff --git a/usr.bin/mandoc/mdoc_term.c b/usr.bin/mandoc/mdoc_term.c
index 2434d19193e..d801804ad01 100644
--- a/usr.bin/mandoc/mdoc_term.c
+++ b/usr.bin/mandoc/mdoc_term.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mdoc_term.c,v 1.207 2015/02/05 01:46:38 schwarze Exp $ */
+/*	$OpenBSD: mdoc_term.c,v 1.208 2015/02/11 14:14:53 schwarze Exp $ */
 /*
  * Copyright (c) 2008, 2009, 2010, 2011 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010, 2012-2015 Ingo Schwarze <schwarze@openbsd.org>
@@ -1987,9 +1987,8 @@ termp_eo_pre(DECL_ARGS)
 	    n->child->end != ENDBODY_NOT)
 		term_word(p, "\\&");
 	else if (n->end != ENDBODY_NOT ? n->child != NULL :
-	     n->parent->head->child != NULL &&
-	     (n->parent->body->child != NULL ||
-	      n->parent->tail->child != NULL))
+	     n->parent->head->child != NULL && (n->child != NULL ||
+	     (n->parent->tail != NULL && n->parent->tail->child != NULL)))
 		p->flags |= TERMP_NOSPACE;
 
 	return(1);