===================================================================
RCS file: /cvs/mandoc/mandoc.c,v
retrieving revision 1.104
retrieving revision 1.105
diff -u -p -r1.104 -r1.105
--- mandoc/mandoc.c	2018/07/28 18:34:15	1.104
+++ mandoc/mandoc.c	2018/08/10 22:12:44	1.105
@@ -1,4 +1,4 @@
-/*	$Id: mandoc.c,v 1.104 2018/07/28 18:34:15 schwarze Exp $ */
+/*	$Id: mandoc.c,v 1.105 2018/08/10 22:12:44 schwarze Exp $ */
 /*
  * Copyright (c) 2008-2011, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2011-2015, 2017, 2018 Ingo Schwarze <schwarze@openbsd.org>
@@ -41,7 +41,7 @@ enum mandoc_esc
 mandoc_escape(const char **end, const char **start, int *sz)
 {
 	const char	*local_start;
-	int		 local_sz;
+	int		 local_sz, c, i;
 	char		 term;
 	enum mandoc_esc	 gly;
 
@@ -330,8 +330,26 @@ mandoc_escape(const char **end, const char **start, in
 		}
 		break;
 	case ESCAPE_SPECIAL:
-		if (1 == *sz && 'c' == **start)
-			gly = ESCAPE_NOSPACE;
+		if (**start == 'c') {
+			if (*sz == 1) {
+				gly = ESCAPE_NOSPACE;
+				break;
+			}
+			if (*sz < 6 || *sz > 7 ||
+			    strncmp(*start, "char", 4) != 0 ||
+			    (int)strspn(*start + 4, "0123456789") + 4 < *sz)
+				break;
+			c = 0;
+			for (i = 4; i < *sz; i++)
+				c = 10 * c + ((*start)[i] - '0');
+			if (c < 0x21 || (c > 0x7e && c < 0xa0) || c > 0xff)
+				break;
+			*start += 4;
+			*sz -= 4;
+			gly = ESCAPE_NUMBERED;
+			break;
+		}
+
 		/*
 		 * Unicode escapes are defined in groff as \[u0000]
 		 * to \[u10FFFF], where the contained value must be