===================================================================
RCS file: /cvs/mandoc/roff_escape.c,v
retrieving revision 1.10
retrieving revision 1.12
diff -u -p -r1.10 -r1.12
--- mandoc/roff_escape.c	2022/06/05 13:54:09	1.10
+++ mandoc/roff_escape.c	2022/06/06 19:23:13	1.12
@@ -1,4 +1,4 @@
-/* $OpenBSD: roff_escape.c,v 1.10 2022/06/05 13:54:09 schwarze Exp $ */
+/* $Id: roff_escape.c,v 1.12 2022/06/06 19:23:13 schwarze Exp $ */
 /*
  * Copyright (c) 2011, 2012, 2013, 2014, 2015, 2017, 2018, 2020, 2022
  *               Ingo Schwarze <schwarze@openbsd.org>
@@ -206,10 +206,6 @@ roff_escape(const char *buf, const int ln, const int a
 		term = '\b';
 		break;
 	case 'C':
-		if (buf[iarg] != '\'') {
-			rval = ESCAPE_ERROR;
-			goto out;
-		}
 		rval = ESCAPE_SPECIAL;
 		term = '\b';
 		break;
@@ -274,12 +270,14 @@ roff_escape(const char *buf, const int ln, const int a
 		goto out_sub;
 
 	if (term == '\b') {
-		if ((buf[inam] == 'N' && isdigit((unsigned char)buf[iarg])) ||
-		    (buf[inam] == 'h' && strchr(" %&()*+-./0123456789:<=>",
-		     buf[iarg]) != NULL)) {
-			iendarg = iend = iarg + 1;
-			rval = ESCAPE_ERROR;
-			goto out;
+		if (strchr("BDHLRSvxNhl", buf[inam]) != NULL &&
+		    strchr(" %&()*+-./0123456789:<=>", buf[iarg]) != NULL) {
+			if (rval != ESCAPE_EXPAND)
+				rval = ESCAPE_ERROR;
+			if (buf[inam] != 'D') {
+				iendarg = iend = iarg + 1;
+				goto out;
+			}
 		}
 		term = buf[iarg++];
 	} else if (term == '\0' && maxl == INT_MAX) {
@@ -391,6 +389,11 @@ roff_escape(const char *buf, const int ln, const int a
 		break;
 
 	case ESCAPE_SPECIAL:
+		if (argl == 0) {
+			err = MANDOCERR_ESC_BADCHAR;
+			rval = ESCAPE_ERROR;
+			break;
+		}
 
 		/*
 		 * The file chars.c only provides one common list of