Even after switching from a pending head to the body, we have to
authorschwarze <schwarze@openbsd.org>
Sat, 13 Aug 2016 09:14:56 +0000 (09:14 +0000)
committerschwarze <schwarze@openbsd.org>
Sat, 13 Aug 2016 09:14:56 +0000 (09:14 +0000)
commit56160448f2bebc951cd528651be685bb3adc4354
treeee93424ecc8038f22776321d2040cc50ea07ddcf
parent808b2b380f86beee0973ad00a558424e6d7af3e0
Even after switching from a pending head to the body, we have to
continue scanning upwards, because the enclosing block might already
be pending as well, e.g. .Bl .Bl .It Bo .El .It.
Tree corruption leading to a later NULL deref found by tb@ with afl(1).
usr.bin/mandoc/mdoc_macro.c