===================================================================
RCS file: /cvs/mandoc/roff.c,v
retrieving revision 1.396
retrieving revision 1.400
diff -u -p -r1.396 -r1.400
--- mandoc/roff.c	2023/04/28 19:11:04	1.396
+++ mandoc/roff.c	2023/10/24 20:53:12	1.400
@@ -1,6 +1,6 @@
-/* $Id: roff.c,v 1.396 2023/04/28 19:11:04 schwarze Exp $ */
+/* $Id: roff.c,v 1.400 2023/10/24 20:53:12 schwarze Exp $ */
 /*
- * Copyright (c) 2010-2015, 2017-2022 Ingo Schwarze <schwarze@openbsd.org>
+ * Copyright (c) 2010-2015, 2017-2023 Ingo Schwarze <schwarze@openbsd.org>
  * Copyright (c) 2008-2012, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -367,7 +367,8 @@ const char *__roff_name[MAN_MAX + 1] = {
 	"PD",		"AT",		"in",
 	"SY",		"YS",		"OP",
 	"EX",		"EE",		"UR",
-	"UE",		"MT",		"ME",		NULL
+	"UE",		"MT",		"ME",		"MR",
+	NULL
 };
 const	char *const *roff_name = __roff_name;
 
@@ -1362,6 +1363,7 @@ roff_expand(struct roff *r, struct buf *buf, int ln, i
 	const char	*res;		/* the string to be pasted */
 	const char	*src;		/* source for copying */
 	char		*dst;		/* destination for copying */
+	enum mandoc_esc	 subtype;	/* return value from roff_escape */
 	int		 iesc;		/* index of leading escape char */
 	int		 inam;		/* index of the escape name */
 	int		 iarg;		/* index beginning the argument */
@@ -1387,7 +1389,7 @@ roff_expand(struct roff *r, struct buf *buf, int ln, i
 		 */
 
 		if (buf->buf[pos] != ec) {
-			if (ec != ASCII_ESC && buf->buf[pos] == '\\') {
+			if (buf->buf[pos] == '\\') {
 				roff_expand_patch(buf, pos, "\\e", pos + 1);
 				pos++;
 			}
@@ -1551,8 +1553,34 @@ roff_expand(struct roff *r, struct buf *buf, int ln, i
 			res = ubuf;
 			break;
 		case 'w':
-			(void)snprintf(ubuf, sizeof(ubuf),
-			    "%d", (iendarg - iarg) * 24);
+			rsz = 0;
+			subtype = ESCAPE_UNDEF;
+			while (iarg < iendarg) {
+				asz = subtype == ESCAPE_SKIPCHAR ? 0 : 1;
+				if (buf->buf[iarg] != '\\') {
+					rsz += asz;
+					iarg++;
+					continue;
+				}
+				switch ((subtype = roff_escape(buf->buf, 0,
+				    iarg, NULL, NULL, NULL, NULL, &iarg))) {
+				case ESCAPE_SPECIAL:
+				case ESCAPE_NUMBERED:
+				case ESCAPE_UNICODE:
+				case ESCAPE_OVERSTRIKE:
+				case ESCAPE_UNDEF:
+					break;
+				case ESCAPE_DEVICE:
+					asz *= 8;
+					break;
+				case ESCAPE_EXPAND:
+					abort();
+				default:
+					continue;
+				}
+				rsz += asz;
+			}
+			(void)snprintf(ubuf, sizeof(ubuf), "%d", rsz * 24);
 			res = ubuf;
 			break;
 		default:
@@ -1632,12 +1660,7 @@ roff_getarg(struct roff *r, char **cpp, int ln, int *p
 				cp++;
 				break;
 			case '\\':
-				/*
-				 * Signal to roff_expand() that an escape
-				 * sequence resulted from copy-in processing
-				 * and needs to be checked or interpolated.
-				 */
-				cp[-pairs] = ASCII_ESC;
+				cp[-pairs] = '\\';
 				newesc = 1;
 				pairs++;
 				cp++;
@@ -1694,7 +1717,7 @@ roff_getarg(struct roff *r, char **cpp, int ln, int *p
 	buf.buf = start;
 	buf.sz = strlen(start) + 1;
 	buf.next = NULL;
-	if (roff_expand(r, &buf, ln, 0, ASCII_ESC) & ROFF_IGN) {
+	if (roff_expand(r, &buf, ln, 0, '\\') == ROFF_IGN) {
 		free(buf.buf);
 		buf.buf = mandoc_strdup("");
 	}