===================================================================
RCS file: /cvs/mandoc/mandocdb.c,v
retrieving revision 1.246
retrieving revision 1.247
diff -u -p -r1.246 -r1.247
--- mandoc/mandocdb.c	2017/04/24 23:06:18	1.246
+++ mandoc/mandocdb.c	2017/05/04 17:48:28	1.247
@@ -1,4 +1,4 @@
-/*	$Id: mandocdb.c,v 1.246 2017/04/24 23:06:18 schwarze Exp $ */
+/*	$Id: mandocdb.c,v 1.247 2017/05/04 17:48:28 schwarze Exp $ */
 /*
  * Copyright (c) 2011, 2012 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2011-2017 Ingo Schwarze <schwarze@openbsd.org>
@@ -302,7 +302,6 @@ static	const struct mdoc_handler __mdocs[MDOC_MAX - MD
 	{ NULL, 0, 0 },  /* En */
 	{ NULL, TYPE_Dx, NODE_NOSRC },  /* Dx */
 	{ NULL, 0, 0 },  /* %Q */
-	{ NULL, 0, 0 },  /* br */
 	{ NULL, 0, 0 },  /* sp */
 	{ NULL, 0, 0 },  /* %U */
 	{ NULL, 0, 0 },  /* Ta */
@@ -1547,8 +1546,11 @@ parse_mdoc(struct mpage *mpage, const struct roff_meta
 {
 
 	for (n = n->child; n != NULL; n = n->next) {
-		if (n->tok == TOKEN_NONE || n->flags & mdocs[n->tok].taboo)
+		if (n->tok == TOKEN_NONE ||
+		    n->tok < ROFF_MAX ||
+		    n->flags & mdocs[n->tok].taboo)
 			continue;
+		assert(n->tok >= MDOC_Dd && n->tok < MDOC_MAX);
 		switch (n->type) {
 		case ROFFT_ELEM:
 		case ROFFT_BLOCK: