mdocml: Protect against accessing "n->next->child" by first checking

[kristaps@mdocml.bsd.lv]

Log Message:
-----------
Protect against accessing "n->next->child" by first checking "n->next".
Noticed in a crash against ".It Nm Fo" with no closing "Fc".
Original patch expanded by schwarze@ then extended even more.

Modified Files:
--------------
    mdocml:
        mdoc_term.c

Revision Data
-------------
Index: mdoc_term.c
===================================================================
RCS file: /usr/vhosts/mdocml.bsd.lv/cvs/mdocml/mdoc_term.c,v
retrieving revision 1.276
retrieving revision 1.277
diff -Lmdoc_term.c -Lmdoc_term.c -u -p -r1.276 -r1.277
--- mdoc_term.c
+++ mdoc_term.c
@@ -806,9 +806,10 @@ termp_it_pre(DECL_ARGS)
 		 * the "overstep" effect in term_flushln() and treat
 		 * this as a `-ohang' list instead.
 		 */
-		if (n->next->child &&
-		    (MDOC_Bl == n->next->child->tok ||
-		     MDOC_Bd == n->next->child->tok))
+		if (NULL != n->next && 
+			NULL != n->next->child &&
+			(MDOC_Bl == n->next->child->tok ||
+			 MDOC_Bd == n->next->child->tok))
 			break;
 
 		p->flags |= TERMP_NOBREAK | TERMP_BRIND | TERMP_HANG;
@@ -862,9 +863,11 @@ termp_it_pre(DECL_ARGS)
 		 * don't want to recalculate rmargin and offsets when
 		 * using `Bd' or `Bl' within `-hang' overstep lists.
 		 */
-		if (MDOC_HEAD == n->type && n->next->child &&
-		    (MDOC_Bl == n->next->child->tok ||
-		     MDOC_Bd == n->next->child->tok))
+		if (MDOC_HEAD == n->type && 
+			NULL != n->next && 
+			NULL != n->next->child &&
+			(MDOC_Bl == n->next->child->tok ||
+			 MDOC_Bd == n->next->child->tok))
 			break;
 		/* FALLTHROUGH */
 	case LIST_bullet:
@@ -1027,7 +1030,8 @@ termp_nm_pre(DECL_ARGS)
 	if (MDOC_HEAD == n->type)
 		synopsis_pre(p, n->parent);
 
-	if (MDOC_HEAD == n->type && n->next->child) {
+	if (MDOC_HEAD == n->type && 
+		NULL != n->next && NULL != n->next->child) {
 		p->flags |= TERMP_NOSPACE | TERMP_NOBREAK | TERMP_BRIND;
 		p->trailspace = 1;
 		p->rmargin = p->offset + term_len(p, 1);
@@ -1055,7 +1059,8 @@ termp_nm_post(DECL_ARGS)
 
 	if (MDOC_BLOCK == n->type) {
 		p->flags &= ~(TERMP_KEEP | TERMP_PREKEEP);
-	} else if (MDOC_HEAD == n->type && n->next->child) {
+	} else if (MDOC_HEAD == n->type && 
+		NULL != n->next && NULL != n->next->child) {
 		term_flushln(p);
 		p->flags &= ~(TERMP_NOBREAK | TERMP_BRIND | TERMP_HANG);
 		p->trailspace = 0;
--
 To unsubscribe send an email to source+unsubscribe@mdocml.bsd.lv