===================================================================
RCS file: /cvs/mandoc/roff.c,v
retrieving revision 1.246
retrieving revision 1.248
diff -u -p -r1.246 -r1.248
--- mandoc/roff.c	2014/12/28 14:16:26	1.246
+++ mandoc/roff.c	2015/01/07 12:19:46	1.248
@@ -1,7 +1,7 @@
-/*	$Id: roff.c,v 1.246 2014/12/28 14:16:26 schwarze Exp $ */
+/*	$Id: roff.c,v 1.248 2015/01/07 12:19:46 schwarze Exp $ */
 /*
- * Copyright (c) 2010, 2011, 2012 Kristaps Dzonsons <kristaps@bsd.lv>
- * Copyright (c) 2010-2014 Ingo Schwarze <schwarze@openbsd.org>
+ * Copyright (c) 2010, 2011, 2012, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
+ * Copyright (c) 2010-2015 Ingo Schwarze <schwarze@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -1163,7 +1163,8 @@ roff_cond_sub(ROFF_ARGS)
 			*ep = '&';
 			roff_ccond(r, ln, ep - buf->buf - 1);
 		}
-		++ep;
+		if (*ep != '\0')
+			++ep;
 	}
 	return(rr ? ROFF_CONT : ROFF_IGN);
 }
@@ -1183,7 +1184,8 @@ roff_cond_text(ROFF_ARGS)
 			*ep = '&';
 			roff_ccond(r, ln, ep - buf->buf - 1);
 		}
-		++ep;
+		if (*ep != '\0')
+			++ep;
 	}
 	return(rr ? ROFF_CONT : ROFF_IGN);
 }
@@ -2167,6 +2169,7 @@ roff_userdef(ROFF_ARGS)
 	buf->buf = n1;
 	if (buf->sz == 0)
 		buf->sz = strlen(buf->buf) + 1;
+	*offs = 0;
 
 	return(buf->sz > 1 && buf->buf[buf->sz - 2] == '\n' ?
 	   ROFF_REPARSE : ROFF_APPEND);