===================================================================
RCS file: /cvs/mandoc/read.c,v
retrieving revision 1.32
retrieving revision 1.35
diff -u -p -r1.32 -r1.35
--- mandoc/read.c	2012/11/16 22:21:05	1.32
+++ mandoc/read.c	2013/05/30 03:52:59	1.35
@@ -1,7 +1,7 @@
-/*	$Id: read.c,v 1.32 2012/11/16 22:21:05 schwarze Exp $ */
+/*	$Id: read.c,v 1.35 2013/05/30 03:52:59 schwarze Exp $ */
 /*
  * Copyright (c) 2008, 2009, 2010, 2011 Kristaps Dzonsons <kristaps@bsd.lv>
- * Copyright (c) 2010, 2011 Ingo Schwarze <schwarze@openbsd.org>
+ * Copyright (c) 2010, 2011, 2012, 2013 Ingo Schwarze <schwarze@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -180,6 +180,7 @@ static	const char * const	mandocerrs[MANDOCERR_MAX] = 
 	"skipping unknown macro",
 	"NOT IMPLEMENTED, please use groff: skipping request",
 	"argument count wrong",
+	"skipping column outside column list",
 	"skipping end of block that is not open",
 	"missing end of block",
 	"scope open on exit",
@@ -327,6 +328,15 @@ mparse_buf_r(struct mparse *curp, struct buf blk, int 
 				break;
 			}
 
+			/*
+			 * Make sure we have space for at least
+			 * one backslash and one other character
+			 * and the trailing NUL byte.
+			 */
+
+			if (pos + 2 >= (int)ln.sz)
+				resize_buf(&ln, 256);
+
 			/* 
 			 * Warn about bogus characters.  If you're using
 			 * non-ASCII encoding, you're screwing your
@@ -343,8 +353,6 @@ mparse_buf_r(struct mparse *curp, struct buf blk, int 
 				mandoc_msg(MANDOCERR_BADCHAR, curp,
 						curp->line, pos, NULL);
 				i++;
-				if (pos >= (int)ln.sz)
-					resize_buf(&ln, 256);
 				ln.buf[pos++] = '?';
 				continue;
 			}
@@ -352,8 +360,6 @@ mparse_buf_r(struct mparse *curp, struct buf blk, int 
 			/* Trailing backslash = a plain char. */
 
 			if ('\\' != blk.buf[i] || i + 1 == (int)blk.sz) {
-				if (pos >= (int)ln.sz)
-					resize_buf(&ln, 256);
 				ln.buf[pos++] = blk.buf[i++];
 				continue;
 			}
@@ -395,11 +401,21 @@ mparse_buf_r(struct mparse *curp, struct buf blk, int 
 				break;
 			}
 
-			/* Some other escape sequence, copy & cont. */
+			/* Catch escaped bogus characters. */
 
-			if (pos + 1 >= (int)ln.sz)
-				resize_buf(&ln, 256);
+			c = (unsigned char) blk.buf[i+1];
 
+			if ( ! (isascii(c) && 
+					(isgraph(c) || isblank(c)))) {
+				mandoc_msg(MANDOCERR_BADCHAR, curp,
+						curp->line, pos, NULL);
+				i += 2;
+				ln.buf[pos++] = '?';
+				continue;
+			}
+
+			/* Some other escape sequence, copy & cont. */
+
 			ln.buf[pos++] = blk.buf[i++];
 			ln.buf[pos++] = blk.buf[i++];
 		}
@@ -740,7 +756,7 @@ mparse_alloc(enum mparset inttype, enum mandoclevel wl
 	curp->inttype = inttype;
 	curp->defos = defos;
 
-	curp->roff = roff_alloc(curp);
+	curp->roff = roff_alloc(inttype, curp);
 	return(curp);
 }