Do not access a NULL pointer when a section has no body,

which can for example happen for .Sh Xo .Sh without .Xc.
Crash found by jsg@ with afl.

4 files changed, 26 insertions, 4 deletions

diff --git a/regress/usr.bin/mandoc/mdoc/Sh/Makefile b/regress/usr.bin/mandoc/mdoc/Sh/Makefile
index 72e987e4926..a740b8fa492 100644
--- a/regress/usr.bin/mandoc/mdoc/Sh/Makefile
+++ b/regress/usr.bin/mandoc/mdoc/Sh/Makefile
@@ -1,9 +1,9 @@
-# $OpenBSD: Makefile,v 1.4 2014/08/14 02:00:53 schwarze Exp $
+# $OpenBSD: Makefile,v 1.5 2014/11/25 03:04:32 schwarze Exp $
 
-REGRESS_TARGETS	= before subbefore first emptyNAME badNAME order
-LINT_TARGETS	= before subbefore first emptyNAME badNAME order
+REGRESS_TARGETS	= before subbefore first emptyNAME badNAME order empty
+LINT_TARGETS	= before subbefore first emptyNAME badNAME order empty
 
-SKIP_GROFF	= subbefore first
+SKIP_GROFF	= subbefore first empty
 SKIP_ASCII	= first
 
 .include <bsd.regress.mk>
diff --git a/regress/usr.bin/mandoc/mdoc/Sh/empty.in b/regress/usr.bin/mandoc/mdoc/Sh/empty.in
new file mode 100644
index 00000000000..c830ac62fd2
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/Sh/empty.in
@@ -0,0 +1,10 @@
+.Dd November 21, 2014
+.Dt SH-EMPTY 1
+.Os OpenBSD
+.Sh NAME
+.Nm Sh-empty
+.Nd empty sections
+.Sh SYNOPSIS
+.Sh DESCRIPTION Xo
+.Sh BUGS
+Quite some.
diff --git a/regress/usr.bin/mandoc/mdoc/Sh/empty.out_ascii b/regress/usr.bin/mandoc/mdoc/Sh/empty.out_ascii
new file mode 100644
index 00000000000..d34892ff314
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/Sh/empty.out_ascii
@@ -0,0 +1,11 @@
+SH-EMPTY(1)                 General Commands Manual                SH-EMPTY(1)
+
+NNAAMMEE
+     SShh--eemmppttyy - empty sections
+
+SSYYNNOOPPSSIISS
+DDEESSCCRRIIPPTTIIOONN
+BBUUGGSS
+     Quite some.
+
+OpenBSD                        November 21, 2014                       OpenBSD
diff --git a/regress/usr.bin/mandoc/mdoc/Sh/empty.out_lint b/regress/usr.bin/mandoc/mdoc/Sh/empty.out_lint
new file mode 100644
index 00000000000..28d05c97c37
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/Sh/empty.out_lint
@@ -0,0 +1 @@
+mandoc: empty.in:9:2: ERROR: inserting missing end of block: Sh breaks Xo