From f7d129dd3e9bdb3fc606929cc3a600b87614b38f Mon Sep 17 00:00:00 2001
From: schwarze <schwarze@openbsd.org>
Date: Mon, 15 Dec 2014 23:42:31 +0000
Subject: [PATCH] Empty conditions count as false. When negated, they still
 count as false. Found when investigating crashes jsg@ found with afl. Not
 completely fixing the crashes yet.

---
 regress/usr.bin/mandoc/roff/cond/ie.in        | 10 +++++++++-
 regress/usr.bin/mandoc/roff/cond/ie.out_ascii |  4 +++-
 usr.bin/mandoc/roff.c                         |  4 +++-
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/regress/usr.bin/mandoc/roff/cond/ie.in b/regress/usr.bin/mandoc/roff/cond/ie.in
index 8eea1a99945..f9ab8bc048c 100644
--- a/regress/usr.bin/mandoc/roff/cond/ie.in
+++ b/regress/usr.bin/mandoc/roff/cond/ie.in
@@ -1,4 +1,4 @@
-.TH IE 1 "July 1, 2014" OpenBSD
+.TH IE 1 "December 16, 2014" OpenBSD
 .SH NAME
 if \- the roff conditional instruction with else-clause
 .SH DESCRIPTION
@@ -17,6 +17,14 @@ after false.\}
 .br
 .el Another else after false.
 .br
+.ie
+Text following an empty condition.
+.el Else after empty condition.
+.br
+.ie !
+Text following negated empty condition.
+.el Else after negated empty condition.
+.br
 .ie n If \&.el\e{ works, nothing follows here:
 .el\{dummy
 BOOHOO\}
diff --git a/regress/usr.bin/mandoc/roff/cond/ie.out_ascii b/regress/usr.bin/mandoc/roff/cond/ie.out_ascii
index b4cf313d3b7..73d3d97cb9e 100644
--- a/regress/usr.bin/mandoc/roff/cond/ie.out_ascii
+++ b/regress/usr.bin/mandoc/roff/cond/ie.out_ascii
@@ -10,8 +10,10 @@ DDEESSCCRRIIPPTTIIOONN
        Text following the true condition.
        Text following the false condition.
        Two-line else after false.
+       Else after empty condition.
+       Else after negated empty condition.
        If .el\{ works, nothing follows here:
 
 
 
-OpenBSD                          July 1, 2014                            IE(1)
+OpenBSD                        December 16, 2014                         IE(1)
diff --git a/usr.bin/mandoc/roff.c b/usr.bin/mandoc/roff.c
index 6ae4208256e..d4d923c965d 100644
--- a/usr.bin/mandoc/roff.c
+++ b/usr.bin/mandoc/roff.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: roff.c,v 1.111 2014/11/19 01:20:18 schwarze Exp $ */
+/*	$OpenBSD: roff.c,v 1.112 2014/12/15 23:42:31 schwarze Exp $ */
 /*
  * Copyright (c) 2010, 2011, 2012 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010-2014 Ingo Schwarze <schwarze@openbsd.org>
@@ -1256,6 +1256,8 @@ roff_evalcond(struct roff *r, int ln, const char *v, int *pos)
 		wanttrue = 1;
 
 	switch (v[*pos]) {
+	case '\0':
+		return(0);
 	case 'n':
 		/* FALLTHROUGH */
 	case 'o':
-- 
2.20.1