Crash in mandoc HEAD

[Kristaps Dzonsons <kristaps@bsd.lv>]

[-- Attachment #1: Type: text/plain, Size: 555 bytes --]

Hi folks,

I managed to crash mandoc(1) today while formatting a manual.  Narrowed 
down:

      1	.Dd $Mdocdate$
      2	.Dt FOO 1
      3	.Os
      4	.Sh NAME
      5	.Nm foo
      6	.Nd bar
      7	.Sh DESCRIPTION
      8	The
      9	.Bl -hang
     10	.It Nm Fo o
     11	xyzzy
     12	.El

In short, the "Fo" is continuing a node subtree perpetually and the HEAD 
for the "It" on line 10 just keeps going.  There's a check for 
"n->next->child" which thus crashes because "n->next" is NULL.

The fix is very simple and enclosed.

Ok?

Best,

Kristaps

[-- Attachment #2: itcrash.diff --]
[-- Type: text/plain, Size: 614 bytes --]

Index: mdoc_term.c
===================================================================
RCS file: /usr/vhosts/mdocml.bsd.lv/cvs/mdocml/mdoc_term.c,v
retrieving revision 1.276
diff -u -p -r1.276 mdoc_term.c
--- mdoc_term.c	10 Aug 2014 23:54:41 -0000	1.276
+++ mdoc_term.c	15 Aug 2014 13:53:07 -0000
@@ -806,7 +806,7 @@ termp_it_pre(DECL_ARGS)
 		 * the "overstep" effect in term_flushln() and treat
 		 * this as a `-ohang' list instead.
 		 */
-		if (n->next->child &&
+		if (NULL != n->next && NULL != n->next->child &&
 		    (MDOC_Bl == n->next->child->tok ||
 		     MDOC_Bd == n->next->child->tok))
 			break;