===================================================================
RCS file: /cvs/mandoc/mandoc.c,v
retrieving revision 1.87
retrieving revision 1.93
diff -u -p -r1.87 -r1.93
--- mandoc/mandoc.c	2014/10/13 17:17:45	1.87
+++ mandoc/mandoc.c	2015/08/29 22:40:05	1.93
@@ -1,7 +1,7 @@
-/*	$Id: mandoc.c,v 1.87 2014/10/13 17:17:45 schwarze Exp $ */
+/*	$Id: mandoc.c,v 1.93 2015/08/29 22:40:05 schwarze Exp $ */
 /*
- * Copyright (c) 2008, 2009, 2010, 2011 Kristaps Dzonsons <kristaps@bsd.lv>
- * Copyright (c) 2011, 2012, 2013, 2014 Ingo Schwarze <schwarze@openbsd.org>
+ * Copyright (c) 2008-2011, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
+ * Copyright (c) 2011-2015 Ingo Schwarze <schwarze@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -95,6 +95,10 @@ mandoc_escape(const char **end, const char **start, in
 	case 'd':
 		/* FALLTHROUGH */
 	case 'u':
+		/* FALLTHROUGH */
+	case ',':
+		/* FALLTHROUGH */
+	case '/':
 		return(ESCAPE_IGNORE);
 
 	/*
@@ -156,16 +160,18 @@ mandoc_escape(const char **end, const char **start, in
 		/* FALLTHROUGH */
 	case 'D':
 		/* FALLTHROUGH */
-	case 'o':
-		/* FALLTHROUGH */
 	case 'R':
 		/* FALLTHROUGH */
 	case 'X':
 		/* FALLTHROUGH */
 	case 'Z':
-		if ('\0' == **start)
-			return(ESCAPE_ERROR);
 		gly = ESCAPE_IGNORE;
+		/* FALLTHROUGH */
+	case 'o':
+		if (**start == '\0')
+			return(ESCAPE_ERROR);
+		if (gly == ESCAPE_ERROR)
+			gly = ESCAPE_OVERSTRIKE;
 		term = **start;
 		*start = ++*end;
 		break;
@@ -225,7 +231,7 @@ mandoc_escape(const char **end, const char **start, in
 
 		/* See +/- counts as a sign. */
 		if ('+' == **end || '-' == **end || ASCII_HYPH == **end)
-			(*end)++;
+			*start = ++*end;
 
 		switch (**end) {
 		case '(':
@@ -240,6 +246,14 @@ mandoc_escape(const char **end, const char **start, in
 			*start = ++*end;
 			term = '\'';
 			break;
+		case '3':
+			/* FALLTHROUGH */
+		case '2':
+			/* FALLTHROUGH */
+		case '1':
+			*sz = (*end)[-1] == 's' &&
+			    isdigit((unsigned char)(*end)[1]) ? 2 : 1;
+			break;
 		default:
 			*sz = 1;
 			break;
@@ -334,13 +348,18 @@ mandoc_escape(const char **end, const char **start, in
 		if (1 == *sz && 'c' == **start)
 			gly = ESCAPE_NOSPACE;
 		/*
-		 * Unicode escapes are defined in groff as \[uXXXX]
+		 * Unicode escapes are defined in groff as \[u0000]
 		 * to \[u10FFFF], where the contained value must be
 		 * a valid Unicode codepoint.  Here, however, only
-		 * check the length and the validity of all digits.
+		 * check the length and range.
 		 */
-		else if (*sz > 4 && *sz < 8 && **start == 'u' &&
-		    (int)strspn(*start + 1, "0123456789ABCDEFabcdef")
+		if (**start != 'u' || *sz < 5 || *sz > 7)
+			break;
+		if (*sz == 7 && ((*start)[1] != '1' || (*start)[2] != '0'))
+			break;
+		if (*sz == 6 && (*start)[1] == '0')
+			break;
+		if ((int)strspn(*start + 1, "0123456789ABCDEFabcdef")
 		    + 1 == *sz)
 			gly = ESCAPE_UNICODE;
 		break;
@@ -475,6 +494,8 @@ time2a(time_t t)
 	int		 isz;
 
 	tm = localtime(&t);
+	if (tm == NULL)
+		return(NULL);
 
 	/*
 	 * Reserve space: