===================================================================
RCS file: /cvs/mandoc/roff.c,v
retrieving revision 1.398
retrieving revision 1.399
diff -u -p -r1.398 -r1.399
--- mandoc/roff.c	2023/10/22 16:02:01	1.398
+++ mandoc/roff.c	2023/10/23 20:25:02	1.399
@@ -1,6 +1,6 @@
-/* $Id: roff.c,v 1.398 2023/10/22 16:02:01 schwarze Exp $ */
+/* $Id: roff.c,v 1.399 2023/10/23 20:25:02 schwarze Exp $ */
 /*
- * Copyright (c) 2010-2015, 2017-2022 Ingo Schwarze <schwarze@openbsd.org>
+ * Copyright (c) 2010-2015, 2017-2023 Ingo Schwarze <schwarze@openbsd.org>
  * Copyright (c) 2008-2012, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -1362,6 +1362,7 @@ roff_expand(struct roff *r, struct buf *buf, int ln, i
 	const char	*res;		/* the string to be pasted */
 	const char	*src;		/* source for copying */
 	char		*dst;		/* destination for copying */
+	enum mandoc_esc	 subtype;	/* return value from roff_escape */
 	int		 iesc;		/* index of leading escape char */
 	int		 inam;		/* index of the escape name */
 	int		 iarg;		/* index beginning the argument */
@@ -1551,8 +1552,34 @@ roff_expand(struct roff *r, struct buf *buf, int ln, i
 			res = ubuf;
 			break;
 		case 'w':
-			(void)snprintf(ubuf, sizeof(ubuf),
-			    "%d", (iendarg - iarg) * 24);
+			rsz = 0;
+			subtype = ESCAPE_UNDEF;
+			while (iarg < iendarg) {
+				asz = subtype == ESCAPE_SKIPCHAR ? 0 : 1;
+				if (buf->buf[iarg] != '\\') {
+					rsz += asz;
+					iarg++;
+					continue;
+				}
+				switch ((subtype = roff_escape(buf->buf, 0,
+				    iarg, NULL, NULL, NULL, NULL, &iarg))) {
+				case ESCAPE_SPECIAL:
+				case ESCAPE_NUMBERED:
+				case ESCAPE_UNICODE:
+				case ESCAPE_OVERSTRIKE:
+				case ESCAPE_UNDEF:
+					break;
+				case ESCAPE_DEVICE:
+					asz *= 8;
+					break;
+				case ESCAPE_EXPAND:
+					abort();
+				default:
+					continue;
+				}
+				rsz += asz;
+			}
+			(void)snprintf(ubuf, sizeof(ubuf), "%d", rsz * 24);
 			res = ubuf;
 			break;
 		default: