When a mismatching end macro occurs while at least two nested blocks

are open, all except the innermost open block got a bogus MDOC_ENDED
marker, in some situations triggering segfaults down the road
which tb@ found with afl(1).
Fix the logic error by figuring out up front whether an end macro
has a matching body, and if it hasn't, don't mark any blocks as broken.

4 files changed, 26 insertions, 4 deletions

diff --git a/regress/usr.bin/mandoc/mdoc/break/Makefile b/regress/usr.bin/mandoc/mdoc/break/Makefile
index e91e20f80fd..b4c3b219163 100644
--- a/regress/usr.bin/mandoc/mdoc/break/Makefile
+++ b/regress/usr.bin/mandoc/mdoc/break/Makefile
@@ -1,7 +1,7 @@
-# $OpenBSD: Makefile,v 1.3 2015/04/05 14:43:10 schwarze Exp $
+# $OpenBSD: Makefile,v 1.4 2016/08/20 17:58:09 schwarze Exp $
 
-REGRESS_TARGETS	= brokenbreaker twice tail two
-LINT_TARGETS	= brokenbreaker twice tail two
+REGRESS_TARGETS	= brokenbreaker twice tail two notopen
+LINT_TARGETS	= brokenbreaker twice tail two notopen
 
 # It's hard to keep stuff together in next-line scope.
 
@@ -10,6 +10,6 @@ SKIP_TMAN	= tail
 # groff-1.22.3 defect:
 # - non-matching enclosure end macro prints a closing delimiter
 
-SKIP_GROFF	= brokenbreaker
+SKIP_GROFF	= brokenbreaker notopen
 
 .include <bsd.regress.mk>
diff --git a/regress/usr.bin/mandoc/mdoc/break/notopen.in b/regress/usr.bin/mandoc/mdoc/break/notopen.in
new file mode 100644
index 00000000000..20a9bf1291f
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/break/notopen.in
@@ -0,0 +1,12 @@
+.Dd August 20, 2016
+.Dt BREAK-NOTOPEN 1
+.Os OpenBSD
+.Sh NAME
+.Nm break-notopen
+.Nd mismatching end macro inside two open blocks
+.Sh DESCRIPTION
+.Ao ao
+.Bo bo pc
+.Pc bc
+.Bc ac
+.Ac tail
diff --git a/regress/usr.bin/mandoc/mdoc/break/notopen.out_ascii b/regress/usr.bin/mandoc/mdoc/break/notopen.out_ascii
new file mode 100644
index 00000000000..db71cc41743
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/break/notopen.out_ascii
@@ -0,0 +1,9 @@
+BREAK-NOTOPEN(1)            General Commands Manual           BREAK-NOTOPEN(1)
+
+NNAAMMEE
+     bbrreeaakk--nnoottooppeenn - mismatching end macro inside two open blocks
+
+DDEESSCCRRIIPPTTIIOONN
+     <ao [bo pc bc] ac> tail
+
+OpenBSD                         August 20, 2016                        OpenBSD
diff --git a/regress/usr.bin/mandoc/mdoc/break/notopen.out_lint b/regress/usr.bin/mandoc/mdoc/break/notopen.out_lint
new file mode 100644
index 00000000000..e70b2f6fe85
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/break/notopen.out_lint
@@ -0,0 +1 @@
+mandoc: notopen.in:10:2: ERROR: skipping end of block that is not open: Pc