Hi Michael,

thanks again for reporting.

Michael Stapelberg wrote on Mon, May 27, 2019 at 08:34:21AM +0200:

> I have encountered one more issue:
>
> % curl -s
> https://manpages.debian.org/testing/mysql-server-5.6/mysqlbinlog.1.en.gz |
> ./mandoc -Thtml
> […]
> free(): invalid pointer
>
> Could you take a look at that, too, please?

I believe that problem was already fixed with this commit:

   2019-03-29 21:27  schwarze

        Changed:
                out.c (1.78), "Exp", lines: +2 -2

        Set the maximum column index in a tbl(7) to the maximum *right*
        edge of any cell span, not to the maximum *left* edge, which may be
        smaller if the last column of the table is only reached by
        horizontal spans, but not by any regular cell in any row of the
        table.  Otherwise, the algorithm calculating column widths accessed
        memomy after the end of the colwidth[] array, while it was trying
        to handle the rightmost column(s).

                Crash reported by Jason Thorpe <thorpej at NetBSD> via
        https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=54069
        and via Thomas Klausner (wiz@).  Christos@ Zoulas sent a (correct,
        but slightly confusing) patch.  The patch i'm committing here is
        easier to understand.

Could you please cross-check whether that patch (appended below)
resolves the problem for you?

Thanks,
  Ingo



Index: out.c
===================================================================
RCS file: /home/cvs/mandoc/mandoc/out.c,v
retrieving revision 1.77
diff -u -p -r1.77 out.c
--- out.c       13 Dec 2018 11:55:47 -0000      1.77
+++ out.c       1 Jun 2019 19:14:23 -0000
@@ -1,4 +1,4 @@
-/*     $Id: out.c,v 1.77 2018/12/13 11:55:47 schwarze Exp $ */
+/*     $Id: out.c,v 1.78 2019/03/29 21:27:06 schwarze Exp $ */
 /*
  * Copyright (c) 2009, 2010, 2011 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2011,2014,2015,2017,2018 Ingo Schwarze <schwarze@openbsd.org>
@@ -149,7 +149,7 @@ tblcalc(struct rofftbl *tbl, const struc
                gp = &first_group;
                for (dp = sp->first; dp != NULL; dp = dp->next) {
                        icol = dp->layout->col;
-                       while (icol > maxcol)
+                       while (maxcol < icol + dp->hspans)
                                tbl->cols[++maxcol].spacing = SIZE_MAX;
                        col = tbl->cols + icol;
                        col->flags |= dp->layout->flags;