===================================================================
RCS file: /cvs/mandoc/roff.c,v
retrieving revision 1.245
retrieving revision 1.250
diff -u -p -r1.245 -r1.250
--- mandoc/roff.c	2014/12/25 17:23:32	1.245
+++ mandoc/roff.c	2015/01/16 16:53:49	1.250
@@ -1,7 +1,7 @@
-/*	$Id: roff.c,v 1.245 2014/12/25 17:23:32 schwarze Exp $ */
+/*	$Id: roff.c,v 1.250 2015/01/16 16:53:49 schwarze Exp $ */
 /*
- * Copyright (c) 2010, 2011, 2012 Kristaps Dzonsons <kristaps@bsd.lv>
- * Copyright (c) 2010-2014 Ingo Schwarze <schwarze@openbsd.org>
+ * Copyright (c) 2010, 2011, 2012, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
+ * Copyright (c) 2010-2015 Ingo Schwarze <schwarze@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -75,6 +75,7 @@ enum	rofft {
 	ROFF_T_,
 	ROFF_EQ,
 	ROFF_EN,
+	ROFF_IX,
 	ROFF_cblock,
 	ROFF_USERDEF,
 	ROFF_MAX
@@ -274,6 +275,7 @@ static	struct roffmac	 roffs[ROFF_MAX] = {
 	{ "T&", roff_T_, NULL, NULL, 0, NULL },
 	{ "EQ", roff_EQ, NULL, NULL, 0, NULL },
 	{ "EN", roff_EN, NULL, NULL, 0, NULL },
+	{ "IX", roff_line_ignore, NULL, NULL, 0, NULL },
 	{ ".", roff_cblock, NULL, NULL, 0, NULL },
 	{ NULL, roff_userdef, NULL, NULL, 0, NULL },
 };
@@ -651,6 +653,10 @@ roff_res(struct roff *r, struct buf *buf, int ln, int 
 			    r->parse, ln, (int)(stesc - buf->buf),
 			    "%.*s", (int)naml, stnam);
 			res = "";
+		} else if (buf->sz + strlen(res) > SHRT_MAX) {
+			mandoc_msg(MANDOCERR_ROFFLOOP, r->parse,
+			    ln, (int)(stesc - buf->buf), NULL);
+			return(ROFF_IGN);
 		}
 
 		/* Replace the escape sequence by the string. */
@@ -659,12 +665,6 @@ roff_res(struct roff *r, struct buf *buf, int ln, int 
 		buf->sz = mandoc_asprintf(&nbuf, "%s%s%s",
 		    buf->buf, res, cp) + 1;
 
-		if (buf->sz > SHRT_MAX) {
-			mandoc_msg(MANDOCERR_ROFFLOOP, r->parse,
-			    ln, (int)(stesc - buf->buf), NULL);
-			return(ROFF_IGN);
-		}
-
 		/* Prepare for the next replacement. */
 
 		start = nbuf + pos;
@@ -1165,7 +1165,8 @@ roff_cond_sub(ROFF_ARGS)
 			*ep = '&';
 			roff_ccond(r, ln, ep - buf->buf - 1);
 		}
-		++ep;
+		if (*ep != '\0')
+			++ep;
 	}
 	return(rr ? ROFF_CONT : ROFF_IGN);
 }
@@ -1185,7 +1186,8 @@ roff_cond_text(ROFF_ARGS)
 			*ep = '&';
 			roff_ccond(r, ln, ep - buf->buf - 1);
 		}
-		++ep;
+		if (*ep != '\0')
+			++ep;
 	}
 	return(rr ? ROFF_CONT : ROFF_IGN);
 }
@@ -2103,7 +2105,7 @@ roff_tr(ROFF_ARGS)
 static enum rofferr
 roff_so(ROFF_ARGS)
 {
-	char *name;
+	char *name, *cp;
 
 	name = buf->buf + pos;
 	mandoc_vmsg(MANDOCERR_SO, r->parse, ln, ppos, "so %s", name);
@@ -2118,7 +2120,12 @@ roff_so(ROFF_ARGS)
 	if (*name == '/' || strstr(name, "../") || strstr(name, "/..")) {
 		mandoc_vmsg(MANDOCERR_SO_PATH, r->parse, ln, ppos,
 		    ".so %s", name);
-		return(ROFF_ERR);
+		buf->sz = mandoc_asprintf(&cp,
+		    ".sp\nSee the file %s.\n.sp", name) + 1;
+		free(buf->buf);
+		buf->buf = cp;
+		*offs = 0;
+		return(ROFF_REPARSE);
 	}
 
 	*offs = pos;
@@ -2169,6 +2176,7 @@ roff_userdef(ROFF_ARGS)
 	buf->buf = n1;
 	if (buf->sz == 0)
 		buf->sz = strlen(buf->buf) + 1;
+	*offs = 0;
 
 	return(buf->sz > 1 && buf->buf[buf->sz - 2] == '\n' ?
 	   ROFF_REPARSE : ROFF_APPEND);