===================================================================
RCS file: /cvs/mandoc/main.c,v
retrieving revision 1.357
retrieving revision 1.360
diff -u -p -r1.357 -r1.360
--- mandoc/main.c	2021/09/04 12:52:57	1.357
+++ mandoc/main.c	2021/10/04 21:29:17	1.360
@@ -1,4 +1,4 @@
-/* $Id: main.c,v 1.357 2021/09/04 12:52:57 schwarze Exp $ */
+/* $Id: main.c,v 1.360 2021/10/04 21:29:17 schwarze Exp $ */
 /*
  * Copyright (c) 2010-2012, 2014-2021 Ingo Schwarze <schwarze@openbsd.org>
  * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps@bsd.lv>
@@ -132,7 +132,7 @@ main(int argc, char *argv[])
 	struct mparse	*mp;		/* Opaque parser object. */
 	const char	*conf_file;	/* -C: alternate config file. */
 	const char	*os_s;		/* -I: Operating system for display. */
-	const char	*progname, *sec;
+	const char	*progname, *sec, *ep;
 	char		*defpaths;	/* -M: override manpaths. */
 	char		*auxpaths;	/* -m: additional manpaths. */
 	char		*oarg;		/* -O: output option string. */
@@ -516,6 +516,9 @@ main(int argc, char *argv[])
 				memcpy(res + ressz, resn,
 				    sizeof(*resn) * resnsz);
 				ressz += resnsz;
+				free(resn);
+				resn = NULL;
+				resnsz = 0;
 				continue;
 			}
 
@@ -536,11 +539,16 @@ main(int argc, char *argv[])
 					sec++; /* Prefer without suffix. */
 				if (*sec != '/')
 					prio += 10; /* Wrong dir name. */
-				if (search.sec != NULL &&
-				    (strlen(sec) <= ssz  + 3 ||
-				     strcmp(sec + strlen(sec) - ssz,
-				      search.sec) != 0))
-					prio += 20; /* Wrong file ext. */
+				if (search.sec != NULL) {
+					ep = strchr(sec, '\0');
+					if (ep - sec > 3 &&
+					    strncmp(ep - 3, ".gz", 3) == 0)
+						ep -= 3;
+					if ((size_t)(ep - sec) < ssz + 3 ||
+					    strncmp(ep - ssz, search.sec,
+					     ssz) != 0)      /* Wrong file */
+						prio += 20;  /* extension. */
+				}
 				if (prio >= best_prio)
 					continue;
 				best_prio = prio;
@@ -549,6 +557,10 @@ main(int argc, char *argv[])
 			res = mandoc_reallocarray(res, ressz + 1,
 			    sizeof(*res));
 			memcpy(res + ressz++, resn + ib, sizeof(*resn));
+			memset(resn + ib, 0, sizeof(*resn));
+			mansearch_free(resn, resnsz);
+			resn = NULL;
+			resnsz = 0;
 		}
 
 	/* apropos(1), whatis(1): Process the full search expression. */
@@ -1274,6 +1286,7 @@ spawn_pager(struct outstate *outst, char *tag_target)
 	char		*argv[MAX_PAGER_ARGS];
 	const char	*pager;
 	char		*cp;
+	size_t		 wordlen;
 #if HAVE_LESS_T
 	size_t		 cmdlen;
 #endif
@@ -1288,7 +1301,6 @@ spawn_pager(struct outstate *outst, char *tag_target)
 		pager = getenv("PAGER");
 	if (pager == NULL || *pager == '\0')
 		pager = BINM_PAGER;
-	cp = mandoc_strdup(pager);
 
 	/*
 	 * Parse the pager command into words.
@@ -1296,16 +1308,12 @@ spawn_pager(struct outstate *outst, char *tag_target)
 	 */
 
 	argc = 0;
-	while (argc + 5 < MAX_PAGER_ARGS) {
-		argv[argc++] = cp;
-		cp = strchr(cp, ' ');
-		if (cp == NULL)
-			break;
-		*cp++ = '\0';
-		while (*cp == ' ')
-			cp++;
-		if (*cp == '\0')
-			break;
+	while (*pager != '\0' && argc + 5 < MAX_PAGER_ARGS) {
+		wordlen = strcspn(pager, " ");
+		argv[argc++] = mandoc_strndup(pager, wordlen);
+		pager += wordlen;
+		while (*pager == ' ')
+			pager++;
 	}
 
 	/* For less(1), use the tag file. */
@@ -1317,10 +1325,10 @@ spawn_pager(struct outstate *outst, char *tag_target)
 		cp = argv[0] + cmdlen - 4;
 		if (strcmp(cp, "less") == 0) {
 			argv[argc++] = mandoc_strdup("-T");
-			argv[argc++] = outst->tag_files->tfn;
+			argv[argc++] = mandoc_strdup(outst->tag_files->tfn);
 			if (tag_target != NULL) {
 				argv[argc++] = mandoc_strdup("-t");
-				argv[argc++] = tag_target;
+				argv[argc++] = mandoc_strdup(tag_target);
 				use_ofn = 0;
 			}
 		}
@@ -1331,7 +1339,7 @@ spawn_pager(struct outstate *outst, char *tag_target)
 			mandoc_asprintf(&argv[argc], "file://%s#%s",
 			    outst->tag_files->ofn, tag_target);
 		else
-			argv[argc] = outst->tag_files->ofn;
+			argv[argc] = mandoc_strdup(outst->tag_files->ofn);
 		argc++;
 	}
 	argv[argc] = NULL;
@@ -1343,6 +1351,8 @@ spawn_pager(struct outstate *outst, char *tag_target)
 	case 0:
 		break;
 	default:
+		while (argc > 0)
+			free(argv[--argc]);
 		(void)setpgid(pager_pid, 0);
 		(void)tcsetpgrp(STDOUT_FILENO, pager_pid);
 #if HAVE_PLEDGE