===================================================================
RCS file: /cvs/mandoc/roff.c,v
retrieving revision 1.375
retrieving revision 1.383
diff -u -p -r1.375 -r1.383
--- mandoc/roff.c	2020/08/03 11:02:57	1.375
+++ mandoc/roff.c	2022/04/24 17:40:22	1.383
@@ -1,6 +1,6 @@
-/* $Id: roff.c,v 1.375 2020/08/03 11:02:57 schwarze Exp $ */
+/* $Id: roff.c,v 1.383 2022/04/24 17:40:22 schwarze Exp $ */
 /*
- * Copyright (c) 2010-2015, 2017-2020 Ingo Schwarze <schwarze@openbsd.org>
+ * Copyright (c) 2010-2015, 2017-2022 Ingo Schwarze <schwarze@openbsd.org>
  * Copyright (c) 2008-2012, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -861,6 +861,7 @@ void
 roff_man_free(struct roff_man *man)
 {
 	roff_man_free1(man);
+	free(man->os_r);
 	free(man);
 }
 
@@ -1400,7 +1401,7 @@ roff_expand(struct roff *r, struct buf *buf, int ln, i
 
 		term = '\0';
 		cp = stesc + 1;
-		if (*cp == 'E')
+		while (*cp == 'E')
 			cp++;
 		esct = cp;
 		switch (*esct) {
@@ -1823,7 +1824,7 @@ roff_parsetext(struct roff *r, struct buf *buf, int po
 }
 
 int
-roff_parseln(struct roff *r, int ln, struct buf *buf, int *offs)
+roff_parseln(struct roff *r, int ln, struct buf *buf, int *offs, size_t len)
 {
 	enum roff_tok	 t;
 	int		 e;
@@ -1834,6 +1835,14 @@ roff_parseln(struct roff *r, int ln, struct buf *buf, 
 
 	ppos = pos = *offs;
 
+	if (len > 80 && r->tbl == NULL && r->eqn == NULL &&
+	    (r->man->flags & ROFF_NOFILL) == 0 &&
+	    strchr(" .\\", buf->buf[pos]) == NULL &&
+	    buf->buf[pos] != r->control &&
+	    strcspn(buf->buf, " ") < 80)
+		mandoc_msg(MANDOCERR_TEXT_LONG, ln, (int)len - 1,
+		    "%.20s...", buf->buf + pos);
+
 	/* Handle in-line equation delimiters. */
 
 	if (r->tbl == NULL &&
@@ -2362,7 +2371,9 @@ roff_cond_checkend(ROFF_ARGS)
 	while ((ep = strchr(ep, '\\')) != NULL) {
 		switch (ep[1]) {
 		case '}':
-			if (rr)
+			if (ep[2] == '\0')
+				ep[0] = '\0';
+			else if (rr)
 				ep[1] = '&';
 			else
 				memmove(ep, ep + 2, strlen(ep + 2) + 1);
@@ -2422,9 +2433,11 @@ roff_cond_sub(ROFF_ARGS)
 			}
 		}
 	} else if (t != TOKEN_NONE &&
-	    (rr || roffs[t].flags & ROFFMAC_STRUCT))
+	    (rr || roffs[t].flags & ROFFMAC_STRUCT)) {
 		irc |= (*roffs[t].proc)(r, t, buf, ln, ppos, pos, offs);
-	else
+		if (irc & ROFF_WHILE)
+			irc &= ~(ROFF_LOOPCONT | ROFF_LOOPEXIT);
+	} else
 		irc |= rr ? ROFF_CONT : ROFF_IGN;
 	return irc;
 }
@@ -3657,7 +3670,9 @@ roff_char(ROFF_ARGS)
 		case ESCAPE_FONTITALIC:
 		case ESCAPE_FONTBOLD:
 		case ESCAPE_FONTBI:
-		case ESCAPE_FONTCW:
+		case ESCAPE_FONTCR:
+		case ESCAPE_FONTCB:
+		case ESCAPE_FONTCI:
 		case ESCAPE_FONTPREV:
 			font++;
 			break;
@@ -3857,8 +3872,9 @@ static int
 roff_shift(ROFF_ARGS)
 {
 	struct mctx	*ctx;
-	int		 levels, i;
+	int		 argpos, levels, i;
 
+	argpos = pos;
 	levels = 1;
 	if (buf->buf[pos] != '\0' &&
 	    roff_evalnum(r, ln, buf->buf, &pos, &levels, 0) == 0) {
@@ -3873,9 +3889,13 @@ roff_shift(ROFF_ARGS)
 	ctx = r->mstack + r->mstackpos;
 	if (levels > ctx->argc) {
 		mandoc_msg(MANDOCERR_SHIFT,
-		    ln, pos, "%d, but max is %d", levels, ctx->argc);
+		    ln, argpos, "%d, but max is %d", levels, ctx->argc);
 		levels = ctx->argc;
 	}
+	if (levels < 0) {
+		mandoc_msg(MANDOCERR_ARG_NEG, ln, argpos, "shift %d", levels);
+		levels = 0;
+	}
 	if (levels == 0)
 		return ROFF_IGN;
 	for (i = 0; i < levels; i++)
@@ -3937,9 +3957,7 @@ roff_userdef(ROFF_ARGS)
 		r->mstacksz += 8;
 	}
 	ctx = r->mstack + r->mstackpos;
-	ctx->argsz = 0;
 	ctx->argc = 0;
-	ctx->argv = NULL;
 
 	/*
 	 * Collect pointers to macro argument strings,