The code already pays attention not to close the same block twice.

Similarly, avoid having the same block break two other blocks.
In some situations, this could lead to an endless loop in rew_sub()
found by jsg@ with afl.
Minimal example:  .Po Ao Pc Bo Pc Ac Bc

6 files changed, 41 insertions, 5 deletions

diff --git a/regress/usr.bin/mandoc/mdoc/Makefile b/regress/usr.bin/mandoc/mdoc/Makefile
index 6006c7da574..532158bebad 100644
--- a/regress/usr.bin/mandoc/mdoc/Makefile
+++ b/regress/usr.bin/mandoc/mdoc/Makefile
@@ -1,9 +1,9 @@
-# $OpenBSD: Makefile,v 1.30 2014/11/27 16:20:27 schwarze Exp $
+# $OpenBSD: Makefile,v 1.31 2014/12/22 23:26:20 schwarze Exp $
 
 SUBDIR  = Ad An Ap Aq Ar At Bd Bf Bk Bl Brq Bx Cd Cm
 SUBDIR += D1 Db Dd Dl Dq Dt Dv Em Eo Er Ev Ex Fd Fl Fo Ft Ic In Lb Li Lk
 SUBDIR += Ms Mt Nd Nm No Ns Oo Op Os Ox Pa Pf Pp Qq Rs Rv
-SUBDIR += Sh Sm Sq St Sx Sy Tn Ux Va Vt Xr blank
+SUBDIR += Sh Sm Sq St Sx Sy Tn Ux Va Vt Xr blank break
 
 .include "../Makefile.sub"
 .include <bsd.subdir.mk>
diff --git a/regress/usr.bin/mandoc/mdoc/break/Makefile b/regress/usr.bin/mandoc/mdoc/break/Makefile
new file mode 100644
index 00000000000..1fd82f7f2cb
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/break/Makefile
@@ -0,0 +1,11 @@
+# $OpenBSD: Makefile,v 1.1 2014/12/22 23:26:20 schwarze Exp $
+
+REGRESS_TARGETS	= twice
+LINT_TARGETS	= twice
+
+# groff-1.22.3 defect:
+# - non-matching enclosure end macro prints a closing delimiter
+
+SKIP_GROFF	= twice
+
+.include <bsd.regress.mk>
diff --git a/regress/usr.bin/mandoc/mdoc/break/twice.in b/regress/usr.bin/mandoc/mdoc/break/twice.in
new file mode 100644
index 00000000000..cb6642a2850
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/break/twice.in
@@ -0,0 +1,14 @@
+.Dd December 23, 2014
+.Dt BREAK-TWICE 1
+.Os OpenBSD
+.Sh NAME
+.Nm break-twice
+.Nd the same block breaking two other blocks
+.Sh DESCRIPTION
+.Po po
+.Ao ao pc
+.Pc
+.Bo bo pc
+.Pc ac
+.Ac bc
+.Bc
diff --git a/regress/usr.bin/mandoc/mdoc/break/twice.out_ascii b/regress/usr.bin/mandoc/mdoc/break/twice.out_ascii
new file mode 100644
index 00000000000..6d91ffa070c
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/break/twice.out_ascii
@@ -0,0 +1,9 @@
+BREAK-TWICE(1)              General Commands Manual             BREAK-TWICE(1)
+
+NNAAMMEE
+     bbrreeaakk--ttwwiiccee - the same block breaking two other blocks
+
+DDEESSCCRRIIPPTTIIOONN
+     (po <ao pc) [bo pc ac> bc]
+
+OpenBSD                        December 23, 2014                       OpenBSD
diff --git a/regress/usr.bin/mandoc/mdoc/break/twice.out_lint b/regress/usr.bin/mandoc/mdoc/break/twice.out_lint
new file mode 100644
index 00000000000..bedf7b2a53c
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/break/twice.out_lint
@@ -0,0 +1,2 @@
+mandoc: twice.in:10:2: WARNING: blocks badly nested: Pc breaks Ao
+mandoc: twice.in:13:2: WARNING: blocks badly nested: Ac breaks Bo
diff --git a/usr.bin/mandoc/mdoc_macro.c b/usr.bin/mandoc/mdoc_macro.c
index 14c686fdeb4..ec6507f01a5 100644
--- a/usr.bin/mandoc/mdoc_macro.c
+++ b/usr.bin/mandoc/mdoc_macro.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mdoc_macro.c,v 1.116 2014/12/20 02:26:42 schwarze Exp $ */
+/*	$OpenBSD: mdoc_macro.c,v 1.117 2014/12/22 23:26:20 schwarze Exp $ */
 /*
  * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010, 2012, 2013, 2014 Ingo Schwarze <schwarze@openbsd.org>
@@ -361,7 +361,7 @@ rew_dohalt(enum mdoct tok, enum mdoc_type type,
 	 * When starting to rewind, skip plain text
 	 * and nodes that have already been rewound.
 	 */
-	if (MDOC_TEXT == p->type || MDOC_VALID & p->flags)
+	if (p->type == MDOC_TEXT || p->flags & (MDOC_VALID | MDOC_BREAK))
 		return(REWIND_MORE);
 
 	/*
@@ -744,7 +744,7 @@ blk_exp_close(MACRO_PROT_ARGS)
 	atok = rew_alt(tok);
 	body = endbody = later = NULL;
 	for (n = mdoc->last; n; n = n->parent) {
-		if (n->flags & MDOC_VALID)
+		if (n->flags & (MDOC_VALID | MDOC_BREAK))
 			continue;
 
 		/* Remember the start of our own body. */