===================================================================
RCS file: /cvs/mandoc/roff.c,v
retrieving revision 1.200
retrieving revision 1.219
diff -u -p -r1.200 -r1.219
--- mandoc/roff.c	2014/03/20 02:57:28	1.200
+++ mandoc/roff.c	2014/07/06 19:09:00	1.219
@@ -1,4 +1,4 @@
-/*	$Id: roff.c,v 1.200 2014/03/20 02:57:28 schwarze Exp $ */
+/*	$Id: roff.c,v 1.219 2014/07/06 19:09:00 schwarze Exp $ */
 /*
  * Copyright (c) 2010, 2011, 2012 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010-2014 Ingo Schwarze <schwarze@openbsd.org>
@@ -26,6 +26,7 @@
 #include <string.h>
 
 #include "mandoc.h"
+#include "mandoc_aux.h"
 #include "libroff.h"
 #include "libmandoc.h"
 
@@ -61,6 +62,7 @@ enum	rofft {
 	ROFF_ns,
 	ROFF_ps,
 	ROFF_rm,
+	ROFF_rr,
 	ROFF_so,
 	ROFF_ta,
 	ROFF_tr,
@@ -135,7 +137,7 @@ struct	roffnode {
 
 #define	ROFF_ARGS	 struct roff *r, /* parse ctx */ \
 			 enum rofft tok, /* tok of macro */ \
-		 	 char **bufp, /* input buffer */ \
+			 char **bufp, /* input buffer */ \
 			 size_t *szp, /* size of input buffer */ \
 			 int ln, /* parse line */ \
 			 int ppos, /* original pos in buffer */ \
@@ -179,31 +181,35 @@ static	enum rofferr	 roff_cond_text(ROFF_ARGS);
 static	enum rofferr	 roff_cond_sub(ROFF_ARGS);
 static	enum rofferr	 roff_ds(ROFF_ARGS);
 static	int		 roff_evalcond(const char *, int *);
+static	int		 roff_evalnum(const char *, int *, int *, int);
+static	int		 roff_evalpar(const char *, int *, int *);
 static	int		 roff_evalstrcond(const char *, int *);
 static	void		 roff_free1(struct roff *);
 static	void		 roff_freereg(struct roffreg *);
 static	void		 roff_freestr(struct roffkv *);
-static	char		*roff_getname(struct roff *, char **, int, int);
+static	size_t		 roff_getname(struct roff *, char **, int, int);
 static	int		 roff_getnum(const char *, int *, int *);
 static	int		 roff_getop(const char *, int *, char *);
 static	int		 roff_getregn(const struct roff *,
 				const char *, size_t);
 static	int		 roff_getregro(const char *name);
-static	const char	*roff_getstrn(const struct roff *, 
+static	const char	*roff_getstrn(const struct roff *,
 				const char *, size_t);
 static	enum rofferr	 roff_it(ROFF_ARGS);
 static	enum rofferr	 roff_line_ignore(ROFF_ARGS);
 static	enum rofferr	 roff_nr(ROFF_ARGS);
 static	void		 roff_openeqn(struct roff *, const char *,
 				int, int, const char *);
-static	enum rofft	 roff_parse(struct roff *, const char *, int *);
+static	enum rofft	 roff_parse(struct roff *, char *, int *,
+				int, int);
 static	enum rofferr	 roff_parsetext(char **, size_t *, int, int *);
-static	enum rofferr	 roff_res(struct roff *, 
+static	enum rofferr	 roff_res(struct roff *,
 				char **, size_t *, int, int);
 static	enum rofferr	 roff_rm(ROFF_ARGS);
+static	enum rofferr	 roff_rr(ROFF_ARGS);
 static	void		 roff_setstr(struct roff *,
 				const char *, const char *, int);
-static	void		 roff_setstrn(struct roffkv **, const char *, 
+static	void		 roff_setstrn(struct roffkv **, const char *,
 				size_t, const char *, size_t, int);
 static	enum rofferr	 roff_so(ROFF_ARGS);
 static	enum rofferr	 roff_tr(ROFF_ARGS);
@@ -250,6 +256,7 @@ static	struct roffmac	 roffs[ROFF_MAX] = {
 	{ "ns", roff_line_ignore, NULL, NULL, 0, NULL },
 	{ "ps", roff_line_ignore, NULL, NULL, 0, NULL },
 	{ "rm", roff_rm, NULL, NULL, 0, NULL },
+	{ "rr", roff_rr, NULL, NULL, 0, NULL },
 	{ "so", roff_so, NULL, NULL, 0, NULL },
 	{ "ta", roff_line_ignore, NULL, NULL, 0, NULL },
 	{ "tr", roff_tr, NULL, NULL, 0, NULL },
@@ -309,6 +316,7 @@ static	const struct predef predefs[PREDEFS_MAX] = {
 static	int	 roffit_lines;  /* number of lines to delay */
 static	char	*roffit_macro;  /* nil-terminated macro line */
 
+
 static void
 roffhash_init(void)
 {
@@ -361,7 +369,6 @@ roffhash_find(const char *p, size_t s)
 	return(ROFF_MAX);
 }
 
-
 /*
  * Pop the current node off of the stack of roff instructions currently
  * pending.
@@ -372,7 +379,7 @@ roffnode_pop(struct roff *r)
 	struct roffnode	*p;
 
 	assert(r->last);
-	p = r->last; 
+	p = r->last;
 
 	r->last = r->last->parent;
 	free(p->name);
@@ -380,7 +387,6 @@ roffnode_pop(struct roff *r)
 	free(p);
 }
 
-
 /*
  * Push a roff node onto the instruction stack.  This must later be
  * removed with roffnode_pop().
@@ -403,7 +409,6 @@ roffnode_push(struct roff *r, enum rofft tok, const ch
 	r->last = p;
 }
 
-
 static void
 roff_free1(struct roff *r)
 {
@@ -453,7 +458,6 @@ roff_reset(struct roff *r)
 	r->control = 0;
 }
 
-
 void
 roff_free(struct roff *r)
 {
@@ -462,7 +466,6 @@ roff_free(struct roff *r)
 	free(r);
 }
 
-
 struct roff *
 roff_alloc(struct mparse *parse, int options)
 {
@@ -472,64 +475,84 @@ roff_alloc(struct mparse *parse, int options)
 	r->parse = parse;
 	r->options = options;
 	r->rstackpos = -1;
-	
+
 	roffhash_init();
 
 	return(r);
 }
 
 /*
- * In the current line, expand user-defined strings ("\*")
- * and references to number registers ("\n").
- * Also check the syntax of other escape sequences.
+ * In the current line, expand escape sequences that tend to get
+ * used in numerical expressions and conditional requests.
+ * Also check the syntax of the remaining escape sequences.
  */
 static enum rofferr
 roff_res(struct roff *r, char **bufp, size_t *szp, int ln, int pos)
 {
-	char		 ubuf[12]; /* buffer to print the number */
-	const char	*stesc;	/* start of an escape sequence ('\\') */
+	char		 ubuf[24]; /* buffer to print the number */
+	const char	*start;	/* start of the string to process */
+	char		*stesc;	/* start of an escape sequence ('\\') */
 	const char	*stnam;	/* start of the name, after "[(*" */
 	const char	*cp;	/* end of the name, e.g. before ']' */
 	const char	*res;	/* the string to be substituted */
 	char		*nbuf;	/* new buffer to copy bufp to */
-	size_t		 nsz;	/* size of the new buffer */
 	size_t		 maxl;  /* expected length of the escape name */
 	size_t		 naml;	/* actual length of the escape name */
 	int		 expand_count;	/* to avoid infinite loops */
+	int		 npos;	/* position in numeric expression */
+	int		 arg_complete; /* argument not interrupted by eol */
+	char		 term;	/* character terminating the escape */
 
 	expand_count = 0;
+	start = *bufp + pos;
+	stesc = strchr(start, '\0') - 1;
+	while (stesc-- > start) {
 
-again:
-	cp = *bufp + pos;
-	while (NULL != (cp = strchr(cp, '\\'))) {
-		stesc = cp++;
+		/* Search backwards for the next backslash. */
 
-		/*
-		 * The second character must be an asterisk or an n.
-		 * If it isn't, skip it anyway:  It is escaped,
-		 * so it can't start another escape sequence.
-		 */
+		if ('\\' != *stesc)
+			continue;
 
-		if ('\0' == *cp)
-			return(ROFF_CONT);
+		/* If it is escaped, skip it. */
 
+		for (cp = stesc - 1; cp >= start; cp--)
+			if ('\\' != *cp)
+				break;
+
+		if (0 == (stesc - cp) % 2) {
+			stesc = (char *)cp;
+			continue;
+		}
+
+		/* Decide whether to expand or to check only. */
+
+		term = '\0';
+		cp = stesc + 1;
 		switch (*cp) {
-		case ('*'):
+		case '*':
 			res = NULL;
 			break;
-		case ('n'):
+		case 'B':
+			/* FALLTHROUGH */
+		case 'w':
+			term = cp[1];
+			/* FALLTHROUGH */
+		case 'n':
 			res = ubuf;
 			break;
 		default:
-			if (ESCAPE_ERROR != mandoc_escape(&cp, NULL, NULL))
-				continue;
-			mandoc_msg
-				(MANDOCERR_BADESCAPE, r->parse, 
-				 ln, (int)(stesc - *bufp), NULL);
-			return(ROFF_CONT);
+			if (ESCAPE_ERROR == mandoc_escape(&cp, NULL, NULL))
+				mandoc_vmsg(MANDOCERR_ESC_BAD,
+				    r->parse, ln, (int)(stesc - *bufp),
+				    "%.*s", (int)(cp - stesc), stesc);
+			continue;
 		}
 
-		cp++;
+		if (EXPAND_LIMIT < ++expand_count) {
+			mandoc_msg(MANDOCERR_ROFFLOOP, r->parse,
+			    ln, (int)(stesc - *bufp), NULL);
+			return(ROFF_IGN);
+		}
 
 		/*
 		 * The third character decides the length
@@ -537,35 +560,44 @@ again:
 		 * Save a pointer to the name.
 		 */
 
-		switch (*cp) {
-		case ('\0'):
-			return(ROFF_CONT);
-		case ('('):
-			cp++;
-			maxl = 2;
-			break;
-		case ('['):
-			cp++;
+		if ('\0' == term) {
+			switch (*++cp) {
+			case '\0':
+				maxl = 0;
+				break;
+			case '(':
+				cp++;
+				maxl = 2;
+				break;
+			case '[':
+				cp++;
+				term = ']';
+				maxl = 0;
+				break;
+			default:
+				maxl = 1;
+				break;
+			}
+		} else {
+			cp += 2;
 			maxl = 0;
-			break;
-		default:
-			maxl = 1;
-			break;
 		}
 		stnam = cp;
 
 		/* Advance to the end of the name. */
 
+		arg_complete = 1;
 		for (naml = 0; 0 == maxl || naml < maxl; naml++, cp++) {
 			if ('\0' == *cp) {
-				mandoc_msg
-					(MANDOCERR_BADESCAPE, 
-					 r->parse, ln, 
-					 (int)(stesc - *bufp), NULL);
-				return(ROFF_CONT);
+				mandoc_msg(MANDOCERR_ESC_BAD, r->parse,
+				    ln, (int)(stesc - *bufp), stesc);
+				arg_complete = 0;
+				break;
 			}
-			if (0 == maxl && ']' == *cp)
+			if (0 == maxl && *cp == term) {
+				cp++;
 				break;
+			}
 		}
 
 		/*
@@ -573,41 +605,51 @@ again:
 		 * undefined, resume searching for escapes.
 		 */
 
-		if (NULL == res)
-			res = roff_getstrn(r, stnam, naml);
-		else
-			snprintf(ubuf, sizeof(ubuf), "%d",
-			    roff_getregn(r, stnam, naml));
+		switch (stesc[1]) {
+		case '*':
+			if (arg_complete)
+				res = roff_getstrn(r, stnam, naml);
+			break;
+		case 'B':
+			npos = 0;
+			ubuf[0] = arg_complete &&
+			    roff_evalnum(stnam, &npos, NULL, 0) &&
+			    stnam + npos + 1 == cp ? '1' : '0';
+			ubuf[1] = '\0';
+			break;
+		case 'n':
+			if (arg_complete)
+				(void)snprintf(ubuf, sizeof(ubuf), "%d",
+				    roff_getregn(r, stnam, naml));
+			else
+				ubuf[0] = '\0';
+			break;
+		case 'w':
+			/* use even incomplete args */
+			(void)snprintf(ubuf, sizeof(ubuf), "%d",
+			    24 * (int)naml);
+			break;
+		}
 
 		if (NULL == res) {
-			mandoc_msg
-				(MANDOCERR_BADESCAPE, r->parse, 
-				 ln, (int)(stesc - *bufp), NULL);
+			mandoc_vmsg(MANDOCERR_STR_UNDEF,
+			    r->parse, ln, (int)(stesc - *bufp),
+			    "%.*s", (int)naml, stnam);
 			res = "";
 		}
 
 		/* Replace the escape sequence by the string. */
 
-		pos = stesc - *bufp;
+		*stesc = '\0';
+		*szp = mandoc_asprintf(&nbuf, "%s%s%s",
+		    *bufp, res, cp) + 1;
 
-		nsz = *szp + strlen(res) + 1;
-		nbuf = mandoc_malloc(nsz);
+		/* Prepare for the next replacement. */
 
-		strlcpy(nbuf, *bufp, (size_t)(stesc - *bufp + 1));
-		strlcat(nbuf, res, nsz);
-		strlcat(nbuf, cp + (maxl ? 0 : 1), nsz);
-
+		start = nbuf + pos;
+		stesc = nbuf + (stesc - *bufp) + strlen(res);
 		free(*bufp);
-
 		*bufp = nbuf;
-		*szp = nsz;
-
-		if (EXPAND_LIMIT >= ++expand_count)
-			goto again;
-
-		/* Just leave the string unexpanded. */
-		mandoc_msg(MANDOCERR_ROFFLOOP, r->parse, ln, pos, NULL);
-		return(ROFF_IGN);
 	}
 	return(ROFF_CONT);
 }
@@ -655,11 +697,7 @@ roff_parsetext(char **bufp, size_t *szp, int pos, int 
 
 	/* Spring the input line trap. */
 	if (1 == roffit_lines) {
-		isz = asprintf(&p, "%s\n.%s", *bufp, roffit_macro);
-		if (-1 == isz) {
-			perror(NULL);
-			exit((int)MANDOCLEVEL_SYSERR);
-		}
+		isz = mandoc_asprintf(&p, "%s\n.%s", *bufp, roffit_macro);
 		free(*bufp);
 		*bufp = p;
 		*szp = isz + 1;
@@ -673,7 +711,7 @@ roff_parsetext(char **bufp, size_t *szp, int pos, int 
 }
 
 enum rofferr
-roff_parseln(struct roff *r, int ln, char **bufp, 
+roff_parseln(struct roff *r, int ln, char **bufp,
 		size_t *szp, int pos, int *offs)
 {
 	enum rofft	 t;
@@ -704,8 +742,7 @@ roff_parseln(struct roff *r, int ln, char **bufp, 
 	if (r->last && ! ctl) {
 		t = r->last->tok;
 		assert(roffs[t].text);
-		e = (*roffs[t].text)
-			(r, t, bufp, szp, ln, pos, pos, offs);
+		e = (*roffs[t].text)(r, t, bufp, szp, ln, pos, pos, offs);
 		assert(ROFF_IGN == e || ROFF_CONT == e);
 		if (ROFF_CONT != e)
 			return(e);
@@ -727,9 +764,8 @@ roff_parseln(struct roff *r, int ln, char **bufp, 
 	if (r->last) {
 		t = r->last->tok;
 		assert(roffs[t].sub);
-		return((*roffs[t].sub)
-				(r, t, bufp, szp, 
-				 ln, ppos, pos, offs));
+		return((*roffs[t].sub)(r, t, bufp, szp,
+		    ln, ppos, pos, offs));
 	}
 
 	/*
@@ -738,33 +774,30 @@ roff_parseln(struct roff *r, int ln, char **bufp, 
 	 * the compilers handle it.
 	 */
 
-	if (ROFF_MAX == (t = roff_parse(r, *bufp, &pos)))
+	if (ROFF_MAX == (t = roff_parse(r, *bufp, &pos, ln, ppos)))
 		return(ROFF_CONT);
 
 	assert(roffs[t].proc);
-	return((*roffs[t].proc)
-			(r, t, bufp, szp, 
-			 ln, ppos, pos, offs));
+	return((*roffs[t].proc)(r, t, bufp, szp, ln, ppos, pos, offs));
 }
 
-
 void
 roff_endparse(struct roff *r)
 {
 
 	if (r->last)
 		mandoc_msg(MANDOCERR_SCOPEEXIT, r->parse,
-				r->last->line, r->last->col, NULL);
+		    r->last->line, r->last->col, NULL);
 
 	if (r->eqn) {
-		mandoc_msg(MANDOCERR_SCOPEEXIT, r->parse, 
-				r->eqn->eqn.ln, r->eqn->eqn.pos, NULL);
+		mandoc_msg(MANDOCERR_SCOPEEXIT, r->parse,
+		    r->eqn->eqn.ln, r->eqn->eqn.pos, NULL);
 		eqn_end(&r->eqn);
 	}
 
 	if (r->tbl) {
-		mandoc_msg(MANDOCERR_SCOPEEXIT, r->parse, 
-				r->tbl->line, r->tbl->pos, NULL);
+		mandoc_msg(MANDOCERR_SCOPEEXIT, r->parse,
+		    r->tbl->line, r->tbl->pos, NULL);
 		tbl_end(&r->tbl);
 	}
 }
@@ -774,33 +807,30 @@ roff_endparse(struct roff *r)
  * form of ".foo xxx" in the usual way.
  */
 static enum rofft
-roff_parse(struct roff *r, const char *buf, int *pos)
+roff_parse(struct roff *r, char *buf, int *pos, int ln, int ppos)
 {
+	char		*cp;
 	const char	*mac;
 	size_t		 maclen;
 	enum rofft	 t;
 
-	if ('\0' == buf[*pos] || '"' == buf[*pos] || 
-			'\t' == buf[*pos] || ' ' == buf[*pos])
+	cp = buf + *pos;
+
+	if ('\0' == *cp || '"' == *cp || '\t' == *cp || ' ' == *cp)
 		return(ROFF_MAX);
 
-	/* We stop the macro parse at an escape, tab, space, or nil. */
+	mac = cp;
+	maclen = roff_getname(r, &cp, ln, ppos);
 
-	mac = buf + *pos;
-	maclen = strcspn(mac, " \\\t\0");
-
 	t = (r->current_string = roff_getstrn(r, mac, maclen))
 	    ? ROFF_USERDEF : roffhash_find(mac, maclen);
 
-	*pos += (int)maclen;
+	if (ROFF_MAX != t)
+		*pos = cp - buf;
 
-	while (buf[*pos] && ' ' == buf[*pos])
-		(*pos)++;
-
 	return(t);
 }
 
-/* ARGSUSED */
 static enum rofferr
 roff_cblock(ROFF_ARGS)
 {
@@ -816,18 +846,18 @@ roff_cblock(ROFF_ARGS)
 	}
 
 	switch (r->last->tok) {
-	case (ROFF_am):
+	case ROFF_am:
 		/* FALLTHROUGH */
-	case (ROFF_ami):
+	case ROFF_ami:
 		/* FALLTHROUGH */
-	case (ROFF_am1):
+	case ROFF_am1:
 		/* FALLTHROUGH */
-	case (ROFF_de):
+	case ROFF_de:
 		/* ROFF_de1 is remapped to ROFF_de in roff_block(). */
 		/* FALLTHROUGH */
-	case (ROFF_dei):
+	case ROFF_dei:
 		/* FALLTHROUGH */
-	case (ROFF_ig):
+	case ROFF_ig:
 		break;
 	default:
 		mandoc_msg(MANDOCERR_NOSCOPE, r->parse, ln, ppos, NULL);
@@ -835,7 +865,8 @@ roff_cblock(ROFF_ARGS)
 	}
 
 	if ((*bufp)[pos])
-		mandoc_msg(MANDOCERR_ARGSLOST, r->parse, ln, pos, NULL);
+		mandoc_vmsg(MANDOCERR_ARG_SKIP, r->parse, ln, pos,
+		    ".. %s", *bufp + pos);
 
 	roffnode_pop(r);
 	roffnode_cleanscope(r);
@@ -843,7 +874,6 @@ roff_cblock(ROFF_ARGS)
 
 }
 
-
 static void
 roffnode_cleanscope(struct roff *r)
 {
@@ -855,7 +885,6 @@ roffnode_cleanscope(struct roff *r)
 	}
 }
 
-
 static void
 roff_ccond(struct roff *r, int ln, int ppos)
 {
@@ -866,11 +895,11 @@ roff_ccond(struct roff *r, int ln, int ppos)
 	}
 
 	switch (r->last->tok) {
-	case (ROFF_el):
+	case ROFF_el:
 		/* FALLTHROUGH */
-	case (ROFF_ie):
+	case ROFF_ie:
 		/* FALLTHROUGH */
-	case (ROFF_if):
+	case ROFF_if:
 		break;
 	default:
 		mandoc_msg(MANDOCERR_NOSCOPE, r->parse, ln, ppos, NULL);
@@ -887,20 +916,19 @@ roff_ccond(struct roff *r, int ln, int ppos)
 	return;
 }
 
-
-/* ARGSUSED */
 static enum rofferr
 roff_block(ROFF_ARGS)
 {
-	int		sv;
-	size_t		sz;
-	char		*name;
+	char		*name, *cp;
+	size_t		 namesz;
 
-	name = NULL;
+	name = cp = *bufp + pos;
+	namesz = 0;
 
 	if (ROFF_ig != tok) {
-		if ('\0' == (*bufp)[pos]) {
-			mandoc_msg(MANDOCERR_NOARGS, r->parse, ln, ppos, NULL);
+		if ('\0' == *cp) {
+			mandoc_msg(MANDOCERR_REQ_EMPTY, r->parse,
+			    ln, ppos, roffs[tok].name);
 			return(ROFF_IGN);
 		}
 
@@ -911,19 +939,15 @@ roff_block(ROFF_ARGS)
 
 		if (ROFF_de1 == tok)
 			tok = ROFF_de;
-		if (ROFF_de == tok)
-			name = *bufp + pos;
-		else
+		else if (ROFF_de != tok)
 			mandoc_msg(MANDOCERR_REQUEST, r->parse, ln, ppos,
 			    roffs[tok].name);
 
-		while ((*bufp)[pos] && ! isspace((unsigned char)(*bufp)[pos]))
-			pos++;
+		namesz = roff_getname(r, &cp, ln, ppos);
+		name[namesz] = '\0';
+	} else
+		name = NULL;
 
-		while (isspace((unsigned char)(*bufp)[pos]))
-			(*bufp)[pos++] = '\0';
-	}
-
 	roffnode_push(r, tok, name, ln, ppos);
 
 	/*
@@ -932,43 +956,26 @@ roff_block(ROFF_ARGS)
 	 * appended from roff_block_text() in multiline mode.
 	 */
 
-	if (ROFF_de == tok)
-		roff_setstr(r, name, "", 0);
+	if (namesz && ROFF_de == tok)
+		roff_setstrn(&r->strtab, name, namesz, "", 0, 0);
 
-	if ('\0' == (*bufp)[pos])
+	if ('\0' == *cp)
 		return(ROFF_IGN);
 
 	/* If present, process the custom end-of-line marker. */
 
-	sv = pos;
-	while ((*bufp)[pos] && ! isspace((unsigned char)(*bufp)[pos]))
-		pos++;
+	name = cp;
+	namesz = roff_getname(r, &cp, ln, ppos);
+	if (namesz)
+		r->last->end = mandoc_strndup(name, namesz);
 
-	/*
-	 * Note: groff does NOT like escape characters in the input.
-	 * Instead of detecting this, we're just going to let it fly and
-	 * to hell with it.
-	 */
+	if ('\0' != *cp)
+		mandoc_vmsg(MANDOCERR_ARG_EXCESS, r->parse,
+		    ln, pos, ".%s ... %s", roffs[tok].name, cp);
 
-	assert(pos > sv);
-	sz = (size_t)(pos - sv);
-
-	if (1 == sz && '.' == (*bufp)[sv])
-		return(ROFF_IGN);
-
-	r->last->end = mandoc_malloc(sz + 1);
-
-	memcpy(r->last->end, *bufp + sv, sz);
-	r->last->end[(int)sz] = '\0';
-
-	if ((*bufp)[pos])
-		mandoc_msg(MANDOCERR_ARGSLOST, r->parse, ln, pos, NULL);
-
 	return(ROFF_IGN);
 }
 
-
-/* ARGSUSED */
 static enum rofferr
 roff_block_sub(ROFF_ARGS)
 {
@@ -989,10 +996,10 @@ roff_block_sub(ROFF_ARGS)
 			if ((*bufp)[i] != r->last->end[j])
 				break;
 
-		if ('\0' == r->last->end[j] && 
-				('\0' == (*bufp)[i] ||
-				 ' ' == (*bufp)[i] ||
-				 '\t' == (*bufp)[i])) {
+		if ('\0' == r->last->end[j] &&
+		    ('\0' == (*bufp)[i] ||
+		     ' '  == (*bufp)[i] ||
+		     '\t' == (*bufp)[i])) {
 			roffnode_pop(r);
 			roffnode_cleanscope(r);
 
@@ -1000,7 +1007,7 @@ roff_block_sub(ROFF_ARGS)
 				i++;
 
 			pos = i;
-			if (ROFF_MAX != roff_parse(r, *bufp, &pos))
+			if (ROFF_MAX != roff_parse(r, *bufp, &pos, ln, ppos))
 				return(ROFF_RERUN);
 			return(ROFF_IGN);
 		}
@@ -1011,7 +1018,7 @@ roff_block_sub(ROFF_ARGS)
 	 * pulling it out of the hashtable.
 	 */
 
-	t = roff_parse(r, *bufp, &pos);
+	t = roff_parse(r, *bufp, &pos, ln, ppos);
 
 	/*
 	 * Macros other than block-end are only significant
@@ -1024,12 +1031,9 @@ roff_block_sub(ROFF_ARGS)
 	}
 
 	assert(roffs[t].proc);
-	return((*roffs[t].proc)(r, t, bufp, szp, 
-				ln, ppos, pos, offs));
+	return((*roffs[t].proc)(r, t, bufp, szp, ln, ppos, pos, offs));
 }
 
-
-/* ARGSUSED */
 static enum rofferr
 roff_block_text(ROFF_ARGS)
 {
@@ -1040,8 +1044,6 @@ roff_block_text(ROFF_ARGS)
 	return(ROFF_IGN);
 }
 
-
-/* ARGSUSED */
 static enum rofferr
 roff_cond_sub(ROFF_ARGS)
 {
@@ -1051,7 +1053,7 @@ roff_cond_sub(ROFF_ARGS)
 
 	rr = r->last->rule;
 	roffnode_cleanscope(r);
-	t = roff_parse(r, *bufp, &pos);
+	t = roff_parse(r, *bufp, &pos, ln, ppos);
 
 	/*
 	 * Fully handle known macros when they are structurally
@@ -1062,7 +1064,7 @@ roff_cond_sub(ROFF_ARGS)
 	    (rr || ROFFMAC_STRUCT & roffs[t].flags)) {
 		assert(roffs[t].proc);
 		return((*roffs[t].proc)(r, t, bufp, szp,
-					ln, ppos, pos, offs));
+		    ln, ppos, pos, offs));
 	}
 
 	/*
@@ -1086,7 +1088,6 @@ roff_cond_sub(ROFF_ARGS)
 	return(rr ? ROFF_CONT : ROFF_IGN);
 }
 
-/* ARGSUSED */
 static enum rofferr
 roff_cond_text(ROFF_ARGS)
 {
@@ -1107,18 +1108,27 @@ roff_cond_text(ROFF_ARGS)
 	return(rr ? ROFF_CONT : ROFF_IGN);
 }
 
+/*
+ * Parse a single signed integer number.  Stop at the first non-digit.
+ * If there is at least one digit, return success and advance the
+ * parse point, else return failure and let the parse point unchanged.
+ * Ignore overflows, treat them just like the C language.
+ */
 static int
 roff_getnum(const char *v, int *pos, int *res)
 {
-	int p, n;
+	int	 myres, n, p;
 
+	if (NULL == res)
+		res = &myres;
+
 	p = *pos;
 	n = v[p] == '-';
 	if (n)
 		p++;
 
 	for (*res = 0; isdigit((unsigned char)v[p]); p++)
-		*res += 10 * *res + v[p] - '0';
+		*res = 10 * *res + v[p] - '0';
 	if (p == *pos + n)
 		return 0;
 
@@ -1129,34 +1139,6 @@ roff_getnum(const char *v, int *pos, int *res)
 	return 1;
 }
 
-static int
-roff_getop(const char *v, int *pos, char *res)
-{
-	int e;
-
-	*res = v[*pos];
-	e = v[*pos + 1] == '=';
-
-	switch (*res) {
-	case '=':
-		break;
-	case '>':
-		if (e)
-			*res = 'g';
-		break;
-	case '<':
-		if (e)
-			*res = 'l';
-		break;
-	default:
-		return(0);
-	}
-
-	*pos += 1 + e;
-
-	return(*res);
-}
-
 /*
  * Evaluate a string comparison condition.
  * The first character is the delimiter.
@@ -1200,11 +1182,14 @@ out:
 	return(match);
 }
 
+/*
+ * Evaluate an optionally negated single character, numerical,
+ * or string condition.
+ */
 static int
 roff_evalcond(const char *v, int *pos)
 {
-	int	 wanttrue, lh, rh;
-	char	 op;
+	int	 wanttrue, number;
 
 	if ('!' == v[*pos]) {
 		wanttrue = 0;
@@ -1213,50 +1198,32 @@ roff_evalcond(const char *v, int *pos)
 		wanttrue = 1;
 
 	switch (v[*pos]) {
-	case ('n'):
+	case 'n':
 		/* FALLTHROUGH */
-	case ('o'):
+	case 'o':
 		(*pos)++;
 		return(wanttrue);
-	case ('c'):
+	case 'c':
 		/* FALLTHROUGH */
-	case ('d'):
+	case 'd':
 		/* FALLTHROUGH */
-	case ('e'):
+	case 'e':
 		/* FALLTHROUGH */
-	case ('r'):
+	case 'r':
 		/* FALLTHROUGH */
-	case ('t'):
+	case 't':
 		(*pos)++;
 		return(!wanttrue);
 	default:
 		break;
 	}
 
-	if (!roff_getnum(v, pos, &lh))
+	if (roff_evalnum(v, pos, &number, 0))
+		return((number > 0) == wanttrue);
+	else
 		return(roff_evalstrcond(v, pos) == wanttrue);
-	if (!roff_getop(v, pos, &op))
-		return((lh > 0) == wanttrue);
-	if (!roff_getnum(v, pos, &rh))
-		return(0);
-
-	switch (op) {
-	case 'g':
-		return((lh >= rh) == wanttrue);
-	case 'l':
-		return((lh <= rh) == wanttrue);
-	case '=':
-		return((lh == rh) == wanttrue);
-	case '>':
-		return((lh > rh) == wanttrue);
-	case '<':
-		return((lh < rh) == wanttrue);
-	default:
-		return(0);
-	}
 }
 
-/* ARGSUSED */
 static enum rofferr
 roff_line_ignore(ROFF_ARGS)
 {
@@ -1264,24 +1231,23 @@ roff_line_ignore(ROFF_ARGS)
 	return(ROFF_IGN);
 }
 
-/* ARGSUSED */
 static enum rofferr
 roff_cond(ROFF_ARGS)
 {
 
 	roffnode_push(r, tok, NULL, ln, ppos);
 
-	/* 
+	/*
 	 * An `.el' has no conditional body: it will consume the value
 	 * of the current rstack entry set in prior `ie' calls or
-	 * defaults to DENY.  
+	 * defaults to DENY.
 	 *
 	 * If we're not an `el', however, then evaluate the conditional.
 	 */
 
 	r->last->rule = ROFF_el == tok ?
-		(r->rstackpos < 0 ? 0 : r->rstack[r->rstackpos--]) :
-		roff_evalcond(*bufp, &pos);
+	    (r->rstackpos < 0 ? 0 : r->rstack[r->rstackpos--]) :
+	    roff_evalcond(*bufp, &pos);
 
 	/*
 	 * An if-else will put the NEGATION of the current evaluated
@@ -1290,8 +1256,8 @@ roff_cond(ROFF_ARGS)
 
 	if (ROFF_ie == tok) {
 		if (r->rstackpos == RSTACK_MAX - 1) {
-			mandoc_msg(MANDOCERR_MEM, 
-				r->parse, ln, ppos, NULL);
+			mandoc_msg(MANDOCERR_MEM,
+			    r->parse, ln, ppos, NULL);
 			return(ROFF_ERR);
 		}
 		r->rstack[++r->rstackpos] = !r->last->rule;
@@ -1322,7 +1288,7 @@ roff_cond(ROFF_ARGS)
 		r->last->endspan = -1;
 		pos += 2;
 		goto out;
-	} 
+	}
 
 	/*
 	 * Anything else following the conditional causes
@@ -1331,7 +1297,8 @@ roff_cond(ROFF_ARGS)
 	 */
 
 	if ('\0' == (*bufp)[pos])
-		mandoc_msg(MANDOCERR_NOARGS, r->parse, ln, ppos, NULL);
+		mandoc_msg(MANDOCERR_COND_EMPTY, r->parse,
+		    ln, ppos, roffs[tok].name);
 
 	r->last->endspan = 1;
 
@@ -1340,37 +1307,235 @@ out:
 	return(ROFF_RERUN);
 }
 
-
-/* ARGSUSED */
 static enum rofferr
 roff_ds(ROFF_ARGS)
 {
-	char		*name, *string;
+	char		*string;
+	const char	*name;
+	size_t		 namesz;
 
 	/*
-	 * A symbol is named by the first word following the macro
-	 * invocation up to a space.  Its value is anything after the
-	 * name's trailing whitespace and optional double-quote.  Thus,
-	 *
-	 *  [.ds foo "bar  "     ]
-	 *
-	 * will have `bar  "     ' as its value.
+	 * The first word is the name of the string.
+	 * If it is empty or terminated by an escape sequence,
+	 * abort the `ds' request without defining anything.
 	 */
 
-	string = *bufp + pos;
-	name = roff_getname(r, &string, ln, pos);
+	name = string = *bufp + pos;
 	if ('\0' == *name)
 		return(ROFF_IGN);
 
-	/* Read past initial double-quote. */
+	namesz = roff_getname(r, &string, ln, pos);
+	if ('\\' == name[namesz])
+		return(ROFF_IGN);
+
+	/* Read past the initial double-quote, if any. */
 	if ('"' == *string)
 		string++;
 
 	/* The rest is the value. */
-	roff_setstr(r, name, string, ROFF_as == tok);
+	roff_setstrn(&r->strtab, name, namesz, string, strlen(string),
+	    ROFF_as == tok);
 	return(ROFF_IGN);
 }
 
+/*
+ * Parse a single operator, one or two characters long.
+ * If the operator is recognized, return success and advance the
+ * parse point, else return failure and let the parse point unchanged.
+ */
+static int
+roff_getop(const char *v, int *pos, char *res)
+{
+
+	*res = v[*pos];
+
+	switch (*res) {
+	case '+':
+		/* FALLTHROUGH */
+	case '-':
+		/* FALLTHROUGH */
+	case '*':
+		/* FALLTHROUGH */
+	case '/':
+		/* FALLTHROUGH */
+	case '%':
+		/* FALLTHROUGH */
+	case '&':
+		/* FALLTHROUGH */
+	case ':':
+		break;
+	case '<':
+		switch (v[*pos + 1]) {
+		case '=':
+			*res = 'l';
+			(*pos)++;
+			break;
+		case '>':
+			*res = '!';
+			(*pos)++;
+			break;
+		case '?':
+			*res = 'i';
+			(*pos)++;
+			break;
+		default:
+			break;
+		}
+		break;
+	case '>':
+		switch (v[*pos + 1]) {
+		case '=':
+			*res = 'g';
+			(*pos)++;
+			break;
+		case '?':
+			*res = 'a';
+			(*pos)++;
+			break;
+		default:
+			break;
+		}
+		break;
+	case '=':
+		if ('=' == v[*pos + 1])
+			(*pos)++;
+		break;
+	default:
+		return(0);
+	}
+	(*pos)++;
+
+	return(*res);
+}
+
+/*
+ * Evaluate either a parenthesized numeric expression
+ * or a single signed integer number.
+ */
+static int
+roff_evalpar(const char *v, int *pos, int *res)
+{
+
+	if ('(' != v[*pos])
+		return(roff_getnum(v, pos, res));
+
+	(*pos)++;
+	if ( ! roff_evalnum(v, pos, res, 1))
+		return(0);
+
+	/*
+	 * Omission of the closing parenthesis
+	 * is an error in validation mode,
+	 * but ignored in evaluation mode.
+	 */
+
+	if (')' == v[*pos])
+		(*pos)++;
+	else if (NULL == res)
+		return(0);
+
+	return(1);
+}
+
+/*
+ * Evaluate a complete numeric expression.
+ * Proceed left to right, there is no concept of precedence.
+ */
+static int
+roff_evalnum(const char *v, int *pos, int *res, int skipwhite)
+{
+	int		 mypos, operand2;
+	char		 operator;
+
+	if (NULL == pos) {
+		mypos = 0;
+		pos = &mypos;
+	}
+
+	if (skipwhite)
+		while (isspace((unsigned char)v[*pos]))
+			(*pos)++;
+
+	if ( ! roff_evalpar(v, pos, res))
+		return(0);
+
+	while (1) {
+		if (skipwhite)
+			while (isspace((unsigned char)v[*pos]))
+				(*pos)++;
+
+		if ( ! roff_getop(v, pos, &operator))
+			break;
+
+		if (skipwhite)
+			while (isspace((unsigned char)v[*pos]))
+				(*pos)++;
+
+		if ( ! roff_evalpar(v, pos, &operand2))
+			return(0);
+
+		if (skipwhite)
+			while (isspace((unsigned char)v[*pos]))
+				(*pos)++;
+
+		if (NULL == res)
+			continue;
+
+		switch (operator) {
+		case '+':
+			*res += operand2;
+			break;
+		case '-':
+			*res -= operand2;
+			break;
+		case '*':
+			*res *= operand2;
+			break;
+		case '/':
+			*res /= operand2;
+			break;
+		case '%':
+			*res %= operand2;
+			break;
+		case '<':
+			*res = *res < operand2;
+			break;
+		case '>':
+			*res = *res > operand2;
+			break;
+		case 'l':
+			*res = *res <= operand2;
+			break;
+		case 'g':
+			*res = *res >= operand2;
+			break;
+		case '=':
+			*res = *res == operand2;
+			break;
+		case '!':
+			*res = *res != operand2;
+			break;
+		case '&':
+			*res = *res && operand2;
+			break;
+		case ':':
+			*res = *res || operand2;
+			break;
+		case 'i':
+			if (operand2 < *res)
+				*res = operand2;
+			break;
+		case 'a':
+			if (operand2 > *res)
+				*res = operand2;
+			break;
+		default:
+			abort();
+		}
+	}
+	return(1);
+}
+
 void
 roff_setreg(struct roff *r, const char *name, int val, char sign)
 {
@@ -1411,17 +1576,17 @@ roff_getregro(const char *name)
 {
 
 	switch (*name) {
-	case ('A'):  /* ASCII approximation mode is always off. */
+	case 'A':  /* ASCII approximation mode is always off. */
 		return(0);
-	case ('g'):  /* Groff compatibility mode is always on. */
+	case 'g':  /* Groff compatibility mode is always on. */
 		return(1);
-	case ('H'):  /* Fixed horizontal resolution. */
+	case 'H':  /* Fixed horizontal resolution. */
 		return (24);
-	case ('j'):  /* Always adjust left margin only. */
+	case 'j':  /* Always adjust left margin only. */
 		return(0);
-	case ('T'):  /* Some output device is always defined. */
+	case 'T':  /* Some output device is always defined. */
 		return(1);
-	case ('V'):  /* Fixed vertical resolution. */
+	case 'V':  /* Fixed vertical resolution. */
 		return (40);
 	default:
 		return (-1);
@@ -1480,48 +1645,79 @@ roff_freereg(struct roffreg *reg)
 	}
 }
 
-/* ARGSUSED */
 static enum rofferr
 roff_nr(ROFF_ARGS)
 {
-	const char	*key;
-	char		*val;
-	size_t		 sz;
+	char		*key, *val;
+	size_t		 keysz;
 	int		 iv;
 	char		 sign;
 
-	val = *bufp + pos;
-	key = roff_getname(r, &val, ln, pos);
+	key = val = *bufp + pos;
+	if ('\0' == *key)
+		return(ROFF_IGN);
 
+	keysz = roff_getname(r, &val, ln, pos);
+	if ('\\' == key[keysz])
+		return(ROFF_IGN);
+	key[keysz] = '\0';
+
 	sign = *val;
 	if ('+' == sign || '-' == sign)
 		val++;
 
-	sz = strspn(val, "0123456789");
-	iv = sz ? mandoc_strntoi(val, sz, 10) : 0;
+	if (roff_evalnum(val, NULL, &iv, 0))
+		roff_setreg(r, key, iv, sign);
 
-	roff_setreg(r, key, iv, sign);
+	return(ROFF_IGN);
+}
 
+static enum rofferr
+roff_rr(ROFF_ARGS)
+{
+	struct roffreg	*reg, **prev;
+	char		*name, *cp;
+	size_t		 namesz;
+
+	name = cp = *bufp + pos;
+	if ('\0' == *name)
+		return(ROFF_IGN);
+	namesz = roff_getname(r, &cp, ln, pos);
+	name[namesz] = '\0';
+
+	prev = &r->regtab;
+	while (1) {
+		reg = *prev;
+		if (NULL == reg || !strcmp(name, reg->key.p))
+			break;
+		prev = &reg->next;
+	}
+	if (NULL != reg) {
+		*prev = reg->next;
+		free(reg->key.p);
+		free(reg);
+	}
 	return(ROFF_IGN);
 }
 
-/* ARGSUSED */
 static enum rofferr
 roff_rm(ROFF_ARGS)
 {
 	const char	 *name;
 	char		 *cp;
+	size_t		  namesz;
 
 	cp = *bufp + pos;
 	while ('\0' != *cp) {
-		name = roff_getname(r, &cp, ln, (int)(cp - *bufp));
-		if ('\0' != *name)
-			roff_setstr(r, name, NULL, 0);
+		name = cp;
+		namesz = roff_getname(r, &cp, ln, (int)(cp - *bufp));
+		roff_setstrn(&r->strtab, name, namesz, NULL, 0, 0);
+		if ('\\' == name[namesz])
+			break;
 	}
 	return(ROFF_IGN);
 }
 
-/* ARGSUSED */
 static enum rofferr
 roff_it(ROFF_ARGS)
 {
@@ -1535,7 +1731,7 @@ roff_it(ROFF_ARGS)
 	cp[len] = '\0';
 	if ((iv = mandoc_strntoi(cp, len, 10)) <= 0) {
 		mandoc_msg(MANDOCERR_NUMERIC, r->parse,
-				ln, ppos, *bufp + 1);
+		    ln, ppos, *bufp + 1);
 		return(ROFF_IGN);
 	}
 	cp += len + 1;
@@ -1546,7 +1742,6 @@ roff_it(ROFF_ARGS)
 	return(ROFF_IGN);
 }
 
-/* ARGSUSED */
 static enum rofferr
 roff_Dd(ROFF_ARGS)
 {
@@ -1559,7 +1754,6 @@ roff_Dd(ROFF_ARGS)
 	return(ROFF_CONT);
 }
 
-/* ARGSUSED */
 static enum rofferr
 roff_TH(ROFF_ARGS)
 {
@@ -1572,7 +1766,6 @@ roff_TH(ROFF_ARGS)
 	return(ROFF_CONT);
 }
 
-/* ARGSUSED */
 static enum rofferr
 roff_TE(ROFF_ARGS)
 {
@@ -1585,7 +1778,6 @@ roff_TE(ROFF_ARGS)
 	return(ROFF_IGN);
 }
 
-/* ARGSUSED */
 static enum rofferr
 roff_T_(ROFF_ARGS)
 {
@@ -1608,7 +1800,7 @@ roff_closeeqn(struct roff *r)
 #endif
 
 static void
-roff_openeqn(struct roff *r, const char *name, int line, 
+roff_openeqn(struct roff *r, const char *name, int line,
 		int offs, const char *buf)
 {
 	struct eqn_node *e;
@@ -1630,7 +1822,6 @@ roff_openeqn(struct roff *r, const char *name, int lin
 	}
 }
 
-/* ARGSUSED */
 static enum rofferr
 roff_EQ(ROFF_ARGS)
 {
@@ -1639,7 +1830,6 @@ roff_EQ(ROFF_ARGS)
 	return(ROFF_IGN);
 }
 
-/* ARGSUSED */
 static enum rofferr
 roff_EN(ROFF_ARGS)
 {
@@ -1648,7 +1838,6 @@ roff_EN(ROFF_ARGS)
 	return(ROFF_IGN);
 }
 
-/* ARGSUSED */
 static enum rofferr
 roff_TS(ROFF_ARGS)
 {
@@ -1670,7 +1859,6 @@ roff_TS(ROFF_ARGS)
 	return(ROFF_IGN);
 }
 
-/* ARGSUSED */
 static enum rofferr
 roff_cc(ROFF_ARGS)
 {
@@ -1687,7 +1875,6 @@ roff_cc(ROFF_ARGS)
 	return(ROFF_IGN);
 }
 
-/* ARGSUSED */
 static enum rofferr
 roff_tr(ROFF_ARGS)
 {
@@ -1709,9 +1896,8 @@ roff_tr(ROFF_ARGS)
 		if ('\\' == *first) {
 			esc = mandoc_escape(&p, NULL, NULL);
 			if (ESCAPE_ERROR == esc) {
-				mandoc_msg
-					(MANDOCERR_BADESCAPE, r->parse, 
-					 ln, (int)(p - *bufp), NULL);
+				mandoc_msg(MANDOCERR_ESC_BAD, r->parse,
+				    ln, (int)(p - *bufp), first);
 				return(ROFF_IGN);
 			}
 			fsz = (size_t)(p - first);
@@ -1721,28 +1907,27 @@ roff_tr(ROFF_ARGS)
 		if ('\\' == *second) {
 			esc = mandoc_escape(&p, NULL, NULL);
 			if (ESCAPE_ERROR == esc) {
-				mandoc_msg
-					(MANDOCERR_BADESCAPE, r->parse, 
-					 ln, (int)(p - *bufp), NULL);
+				mandoc_msg(MANDOCERR_ESC_BAD, r->parse,
+				    ln, (int)(p - *bufp), second);
 				return(ROFF_IGN);
 			}
 			ssz = (size_t)(p - second);
 		} else if ('\0' == *second) {
-			mandoc_msg(MANDOCERR_ARGCOUNT, r->parse, 
-					ln, (int)(p - *bufp), NULL);
+			mandoc_msg(MANDOCERR_ARGCOUNT, r->parse,
+			    ln, (int)(p - *bufp), NULL);
 			second = " ";
 			p--;
 		}
 
 		if (fsz > 1) {
-			roff_setstrn(&r->xmbtab, first, 
-					fsz, second, ssz, 0);
+			roff_setstrn(&r->xmbtab, first, fsz,
+			    second, ssz, 0);
 			continue;
 		}
 
 		if (NULL == r->xtab)
-			r->xtab = mandoc_calloc
-				(128, sizeof(struct roffstr));
+			r->xtab = mandoc_calloc(128,
+			    sizeof(struct roffstr));
 
 		free(r->xtab[(int)*first].p);
 		r->xtab[(int)*first].p = mandoc_strndup(second, ssz);
@@ -1752,13 +1937,13 @@ roff_tr(ROFF_ARGS)
 	return(ROFF_IGN);
 }
 
-/* ARGSUSED */
 static enum rofferr
 roff_so(ROFF_ARGS)
 {
 	char *name;
 
-	mandoc_msg(MANDOCERR_SO, r->parse, ln, ppos, NULL);
+	name = *bufp + pos;
+	mandoc_vmsg(MANDOCERR_SO, r->parse, ln, ppos, ".so %s", name);
 
 	/*
 	 * Handle `so'.  Be EXTREMELY careful, as we shouldn't be
@@ -1767,9 +1952,9 @@ roff_so(ROFF_ARGS)
 	 * or using absolute paths.
 	 */
 
-	name = *bufp + pos;
 	if ('/' == *name || strstr(name, "../") || strstr(name, "/..")) {
-		mandoc_msg(MANDOCERR_SOPATH, r->parse, ln, pos, NULL);
+		mandoc_vmsg(MANDOCERR_SO_PATH, r->parse, ln, ppos,
+		    ".so %s", name);
 		return(ROFF_ERR);
 	}
 
@@ -1777,7 +1962,6 @@ roff_so(ROFF_ARGS)
 	return(ROFF_SO);
 }
 
-/* ARGSUSED */
 static enum rofferr
 roff_userdef(ROFF_ARGS)
 {
@@ -1806,14 +1990,9 @@ roff_userdef(ROFF_ARGS)
 			cp += 2;
 			continue;
 		}
-
-		*szp = strlen(n1) - 3 + strlen(arg[i]) + 1;
-		n2 = mandoc_malloc(*szp);
-
-		strlcpy(n2, n1, (size_t)(cp - n1 + 1));
-		strlcat(n2, arg[i], *szp);
-		strlcat(n2, cp + 3, *szp);
-
+		*cp = '\0';
+		*szp = mandoc_asprintf(&n2, "%s%s%s",
+		    n1, arg[i], cp + 3) + 1;
 		cp = n2 + (cp - n1);
 		free(n1);
 		n1 = n2;
@@ -1832,37 +2011,41 @@ roff_userdef(ROFF_ARGS)
 	   ROFF_REPARSE : ROFF_APPEND);
 }
 
-static char *
+static size_t
 roff_getname(struct roff *r, char **cpp, int ln, int pos)
 {
 	char	 *name, *cp;
+	size_t	  namesz;
 
 	name = *cpp;
 	if ('\0' == *name)
-		return(name);
+		return(0);
 
-	/* Read until end of name. */
-	for (cp = name; '\0' != *cp && ' ' != *cp; cp++) {
+	/* Read until end of name and terminate it with NUL. */
+	for (cp = name; 1; cp++) {
+		if ('\0' == *cp || ' ' == *cp) {
+			namesz = cp - name;
+			break;
+		}
 		if ('\\' != *cp)
 			continue;
+		namesz = cp - name;
+		if ('{' == cp[1] || '}' == cp[1])
+			break;
 		cp++;
 		if ('\\' == *cp)
 			continue;
 		mandoc_msg(MANDOCERR_NAMESC, r->parse, ln, pos, NULL);
-		*cp = '\0';
-		name = cp;
+		mandoc_escape((const char **)&cp, NULL, NULL);
+		break;
 	}
 
-	/* Nil-terminate name. */
-	if ('\0' != *cp)
-		*(cp++) = '\0';
-
 	/* Read past spaces. */
 	while (' ' == *cp)
 		cp++;
 
 	*cpp = cp;
-	return(name);
+	return(namesz);
 }
 
 /*
@@ -1878,7 +2061,7 @@ roff_setstr(struct roff *r, const char *name, const ch
 {
 
 	roff_setstrn(&r->strtab, name, strlen(name), string,
-			string ? strlen(string) : 0, append);
+	    string ? strlen(string) : 0, append);
 }
 
 static void
@@ -1893,7 +2076,8 @@ roff_setstrn(struct roffkv **r, const char *name, size
 	/* Search for an existing string with the same name. */
 	n = *r;
 
-	while (n && strcmp(name, n->key.p))
+	while (n && (namesz != n->key.sz ||
+			strncmp(n->key.p, name, namesz)))
 		n = n->next;
 
 	if (NULL == n) {
@@ -1959,8 +2143,8 @@ roff_getstrn(const struct roff *r, const char *name, s
 	int i;
 
 	for (n = r->strtab; n; n = n->next)
-		if (0 == strncmp(name, n->key.p, len) && 
-				'\0' == n->key.p[(int)len])
+		if (0 == strncmp(name, n->key.p, len) &&
+		    '\0' == n->key.p[(int)len])
 			return(n->val.p);
 
 	for (i = 0; i < PREDEFS_MAX; i++)
@@ -1987,14 +2171,14 @@ roff_freestr(struct roffkv *r)
 const struct tbl_span *
 roff_span(const struct roff *r)
 {
-	
+
 	return(r->tbl ? tbl_span(r->tbl) : NULL);
 }
 
 const struct eqn *
 roff_eqn(const struct roff *r)
 {
-	
+
 	return(r->last_eqn ? &r->last_eqn->eqn : NULL);
 }
 
@@ -2053,8 +2237,8 @@ roff_strdup(const struct roff *r, const char *p)
 			 * Append the match to the array and move
 			 * forward by its keysize.
 			 */
-			res = mandoc_realloc
-				(res, ssz + cp->val.sz + 1);
+			res = mandoc_realloc(res,
+			    ssz + cp->val.sz + 1);
 			memcpy(res + ssz, cp->val.p, cp->val.sz);
 			ssz += cp->val.sz;
 			p += (int)cp->key.sz;
@@ -2075,8 +2259,8 @@ roff_strdup(const struct roff *r, const char *p)
 			memcpy(res + ssz, pp, sz);
 			break;
 		}
-		/* 
-		 * We bail out on bad escapes. 
+		/*
+		 * We bail out on bad escapes.
 		 * No need to warn: we already did so when
 		 * roff_res() was called.
 		 */
@@ -2091,7 +2275,7 @@ roff_strdup(const struct roff *r, const char *p)
 }
 
 /*
- * Find out whether a line is a macro line or not.  
+ * Find out whether a line is a macro line or not.
  * If it is, adjust the current position and return one; if it isn't,
  * return zero and don't change the current position.
  * If the control character has been set with `.cc', then let that grain