===================================================================
RCS file: /cvs/mandoc/roff.c,v
retrieving revision 1.196
retrieving revision 1.197
diff -u -p -r1.196 -r1.197
--- mandoc/roff.c	2014/03/07 18:30:11	1.196
+++ mandoc/roff.c	2014/03/07 18:37:37	1.197
@@ -1,4 +1,4 @@
-/*	$Id: roff.c,v 1.196 2014/03/07 18:30:11 schwarze Exp $ */
+/*	$Id: roff.c,v 1.197 2014/03/07 18:37:37 schwarze Exp $ */
 /*
  * Copyright (c) 2010, 2011, 2012 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010-2014 Ingo Schwarze <schwarze@openbsd.org>
@@ -1082,10 +1082,11 @@ roff_cond_sub(ROFF_ARGS)
 	/* Always check for the closing delimiter `\}'. */
 
 	while (NULL != (ep = strchr(ep, '\\'))) {
-		if ('}' != *(++ep))
-			continue;
-		*ep = '&';
-		roff_ccond(r, ln, pos);
+		if ('}' == *(++ep)) {
+			*ep = '&';
+			roff_ccond(r, ln, ep - *bufp - 1);
+		}
+		++ep;
 	}
 	return(ROFFRULE_DENY == rr ? ROFF_IGN : ROFF_CONT);
 }
@@ -1100,13 +1101,13 @@ roff_cond_text(ROFF_ARGS)
 	rr = r->last->rule;
 	roffnode_cleanscope(r);
 
-	ep = &(*bufp)[pos];
-	for ( ; NULL != (ep = strchr(ep, '\\')); ep++) {
-		ep++;
-		if ('}' != *ep)
-			continue;
-		*ep = '&';
-		roff_ccond(r, ln, pos);
+	ep = *bufp + pos;
+	while (NULL != (ep = strchr(ep, '\\'))) {
+		if ('}' == *(++ep)) {
+			*ep = '&';
+			roff_ccond(r, ln, ep - *bufp - 1);
+		}
+		++ep;
 	}
 	return(ROFFRULE_DENY == rr ? ROFF_IGN : ROFF_CONT);
 }