===================================================================
RCS file: /cvs/mandoc/chars.c,v
retrieving revision 1.39
retrieving revision 1.40
diff -u -p -r1.39 -r1.40
--- mandoc/chars.c	2011/04/30 22:24:31	1.39
+++ mandoc/chars.c	2011/05/01 08:38:56	1.40
@@ -1,4 +1,4 @@
-/*	$Id: chars.c,v 1.39 2011/04/30 22:24:31 kristaps Exp $ */
+/*	$Id: chars.c,v 1.40 2011/05/01 08:38:56 kristaps Exp $ */
 /*
  * Copyright (c) 2009, 2010 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2011 Ingo Schwarze <schwarze@openbsd.org>
@@ -20,6 +20,7 @@
 #endif
 
 #include <assert.h>
+#include <ctype.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -135,9 +136,11 @@ mchars_res2cp(struct mchars *arg, const char *p, size_
 	return(ln->unicode);
 }
 
-
 /*
  * Numbered character to literal character.
+ * This can only be a printable character (i.e., alnum, punct, space) so
+ * prevent the character from ruining our state (backspace, newline, and
+ * so on).
  */
 char
 mchars_num2char(const char *p, size_t sz)
@@ -148,15 +151,9 @@ mchars_num2char(const char *p, size_t sz)
 		return('\0');
 
 	i = atoi(p);
-	/* 
-	 * FIXME:
-	 * This is wrong.  Anything could be written here!
-	 * This should be carefully screened for possible characters.
-	 */
-	return(i <= 0 || i > 255 ? '\0' : (char)i);
+	return(isprint(i) ? (char)i : '\0');
 }
 
-
 /* 
  * Special character to string array.
  */
@@ -172,7 +169,6 @@ mchars_spec2str(struct mchars *arg, const char *p, siz
 	*rsz = strlen(ln->ascii);
 	return(ln->ascii);
 }
-
 
 /* 
  * Reserved word to string array.