[src/trunk]: src/external/bsd/mdocml/dist CID 1288934: Use after free.

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/c59ff47ea13b
branches:  trunk
changeset: 346535:c59ff47ea13b
user:      christos <christos%NetBSD.org@localhost>
date:      Mon Jul 18 16:56:04 2016 +0000

description:
CID 1288934: Use after free.

diffstat:

 external/bsd/mdocml/dist/mdoc_validate.c |  5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diffs (15 lines):

diff -r 92f9a6d3d08b -r c59ff47ea13b external/bsd/mdocml/dist/mdoc_validate.c
--- a/external/bsd/mdocml/dist/mdoc_validate.c  Mon Jul 18 12:17:39 2016 +0000
+++ b/external/bsd/mdocml/dist/mdoc_validate.c  Mon Jul 18 16:56:04 2016 +0000
@@ -812,6 +812,11 @@
                    "Fo ... %s", n->child->next->string);
                while (n->child != n->last)
                        roff_node_delete(mdoc, n->last);
+               while (n->child != n->last) {
+                       struct mdoc_node *p = n->last;
+                       mdoc_node_delete(mdoc, p);
+               }
+
        }
 
        post_fname(mdoc);