===================================================================
RCS file: /cvs/mandoc/roff.c,v
retrieving revision 1.393
retrieving revision 1.400
diff -u -p -r1.393 -r1.400
--- mandoc/roff.c	2022/06/03 12:15:55	1.393
+++ mandoc/roff.c	2023/10/24 20:53:12	1.400
@@ -1,6 +1,6 @@
-/* $Id: roff.c,v 1.393 2022/06/03 12:15:55 schwarze Exp $ */
+/* $Id: roff.c,v 1.400 2023/10/24 20:53:12 schwarze Exp $ */
 /*
- * Copyright (c) 2010-2015, 2017-2022 Ingo Schwarze <schwarze@openbsd.org>
+ * Copyright (c) 2010-2015, 2017-2023 Ingo Schwarze <schwarze@openbsd.org>
  * Copyright (c) 2008-2012, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -40,14 +40,6 @@
 #include "tbl_parse.h"
 #include "eqn_parse.h"
 
-/*
- * ASCII_ESC is used to signal from roff_getarg() to roff_expand()
- * that an escape sequence resulted from copy-in processing and
- * needs to be checked or interpolated.  As it is used nowhere
- * else, it is defined here rather than in a header file.
- */
-#define	ASCII_ESC	27
-
 /* Maximum number of string expansions per line, to break infinite loops. */
 #define	EXPAND_LIMIT	1000
 
@@ -375,7 +367,8 @@ const char *__roff_name[MAN_MAX + 1] = {
 	"PD",		"AT",		"in",
 	"SY",		"YS",		"OP",
 	"EX",		"EE",		"UR",
-	"UE",		"MT",		"ME",		NULL
+	"UE",		"MT",		"ME",		"MR",
+	NULL
 };
 const	char *const *roff_name = __roff_name;
 
@@ -1370,6 +1363,7 @@ roff_expand(struct roff *r, struct buf *buf, int ln, i
 	const char	*res;		/* the string to be pasted */
 	const char	*src;		/* source for copying */
 	char		*dst;		/* destination for copying */
+	enum mandoc_esc	 subtype;	/* return value from roff_escape */
 	int		 iesc;		/* index of leading escape char */
 	int		 inam;		/* index of the escape name */
 	int		 iarg;		/* index beginning the argument */
@@ -1395,7 +1389,7 @@ roff_expand(struct roff *r, struct buf *buf, int ln, i
 		 */
 
 		if (buf->buf[pos] != ec) {
-			if (ec != ASCII_ESC && buf->buf[pos] == '\\') {
+			if (buf->buf[pos] == '\\') {
 				roff_expand_patch(buf, pos, "\\e", pos + 1);
 				pos++;
 			}
@@ -1457,7 +1451,7 @@ roff_expand(struct roff *r, struct buf *buf, int ln, i
 				break;
 
 			/*
-			 * If not overriden,
+			 * If not overridden,
 			 * let \*(.T through to the formatters.
 			 */
 
@@ -1559,8 +1553,34 @@ roff_expand(struct roff *r, struct buf *buf, int ln, i
 			res = ubuf;
 			break;
 		case 'w':
-			(void)snprintf(ubuf, sizeof(ubuf),
-			    "%d", (iendarg - iarg) * 24);
+			rsz = 0;
+			subtype = ESCAPE_UNDEF;
+			while (iarg < iendarg) {
+				asz = subtype == ESCAPE_SKIPCHAR ? 0 : 1;
+				if (buf->buf[iarg] != '\\') {
+					rsz += asz;
+					iarg++;
+					continue;
+				}
+				switch ((subtype = roff_escape(buf->buf, 0,
+				    iarg, NULL, NULL, NULL, NULL, &iarg))) {
+				case ESCAPE_SPECIAL:
+				case ESCAPE_NUMBERED:
+				case ESCAPE_UNICODE:
+				case ESCAPE_OVERSTRIKE:
+				case ESCAPE_UNDEF:
+					break;
+				case ESCAPE_DEVICE:
+					asz *= 8;
+					break;
+				case ESCAPE_EXPAND:
+					abort();
+				default:
+					continue;
+				}
+				rsz += asz;
+			}
+			(void)snprintf(ubuf, sizeof(ubuf), "%d", rsz * 24);
 			res = ubuf;
 			break;
 		default:
@@ -1640,8 +1660,8 @@ roff_getarg(struct roff *r, char **cpp, int ln, int *p
 				cp++;
 				break;
 			case '\\':
+				cp[-pairs] = '\\';
 				newesc = 1;
-				cp[-pairs] = ASCII_ESC;
 				pairs++;
 				cp++;
 				break;
@@ -1697,7 +1717,7 @@ roff_getarg(struct roff *r, char **cpp, int ln, int *p
 	buf.buf = start;
 	buf.sz = strlen(start) + 1;
 	buf.next = NULL;
-	if (roff_expand(r, &buf, ln, 0, ASCII_ESC) & ROFF_IGN) {
+	if (roff_expand(r, &buf, ln, 0, '\\') == ROFF_IGN) {
 		free(buf.buf);
 		buf.buf = mandoc_strdup("");
 	}
@@ -2482,7 +2502,7 @@ roff_getnum(const char *v, int *pos, int *res, int fla
  * Evaluate a string comparison condition.
  * The first character is the delimiter.
  * Succeed if the string up to its second occurrence
- * matches the string up to its third occurence.
+ * matches the string up to its third occurrence.
  * Advance the cursor after the third occurrence
  * or lacking that, to the end of the line.
  */
@@ -3740,7 +3760,6 @@ roff_tr(ROFF_ARGS)
 {
 	const char	*p, *first, *second;
 	size_t		 fsz, ssz;
-	enum mandoc_esc	 esc;
 
 	p = buf->buf + pos;
 
@@ -3754,23 +3773,15 @@ roff_tr(ROFF_ARGS)
 
 		first = p++;
 		if (*first == '\\') {
-			esc = mandoc_escape(&p, NULL, NULL);
-			if (esc == ESCAPE_ERROR) {
-				mandoc_msg(MANDOCERR_ESC_BAD, ln,
-				    (int)(p - buf->buf), "%s", first);
+			if (mandoc_escape(&p, NULL, NULL) == ESCAPE_ERROR)
 				return ROFF_IGN;
-			}
 			fsz = (size_t)(p - first);
 		}
 
 		second = p++;
 		if (*second == '\\') {
-			esc = mandoc_escape(&p, NULL, NULL);
-			if (esc == ESCAPE_ERROR) {
-				mandoc_msg(MANDOCERR_ESC_BAD, ln,
-				    (int)(p - buf->buf), "%s", second);
+			if (mandoc_escape(&p, NULL, NULL) == ESCAPE_ERROR)
 				return ROFF_IGN;
-			}
 			ssz = (size_t)(p - second);
 		} else if (*second == '\0') {
 			mandoc_msg(MANDOCERR_TR_ODD, ln,
@@ -4383,7 +4394,7 @@ roff_getformat(const struct roff *r)
  * return zero and don't change the current position.
  * If the control character has been set with `.cc', then let that grain
  * precedence.
- * This is slighly contrary to groff, where using the non-breaking
+ * This is slightly contrary to groff, where using the non-breaking
  * control character when `cc' has been invoked will cause the
  * non-breaking macro contents to be printed verbatim.
  */