+ assert(roffs[t].proc);
+ return((*roffs[t].proc)(r, t, bufp, szp,
+ ln, ppos, pos, offs));
+}
+
+
+/* ARGSUSED */
+static enum rofferr
+roff_block_text(ROFF_ARGS)
+{
+
+ if (ROFF_de == tok)
+ roff_setstr(r, r->last->name, *bufp + pos, 1);
+
+ return(ROFF_IGN);
+}
+
+
+/* ARGSUSED */
+static enum rofferr
+roff_cond_sub(ROFF_ARGS)
+{
+ enum rofft t;
+ enum roffrule rr;
+ char *ep;
+
+ rr = r->last->rule;
+ roffnode_cleanscope(r);
+
+ /*
+ * If the macro is unknown, first check if it contains a closing
+ * delimiter `\}'. If it does, close out our scope and return
+ * the currently-scoped rule (ignore or continue). Else, drop
+ * into the currently-scoped rule.
+ */
+
+ if (ROFF_MAX == (t = roff_parse(r, *bufp, &pos))) {
+ ep = &(*bufp)[pos];
+ for ( ; NULL != (ep = strchr(ep, '\\')); ep++) {
+ ep++;
+ if ('}' != *ep)
+ continue;
+
+ /*
+ * Make the \} go away.
+ * This is a little haphazard, as it's not quite
+ * clear how nroff does this.
+ * If we're at the end of line, then just chop
+ * off the \} and resize the buffer.
+ * If we aren't, then conver it to spaces.
+ */
+
+ if ('\0' == *(ep + 1)) {
+ *--ep = '\0';
+ *szp -= 2;
+ } else
+ *(ep - 1) = *ep = ' ';
+
+ roff_ccond(r, ROFF_ccond, bufp, szp,
+ ln, pos, pos + 2, offs);
+ break;
+ }
+ return(ROFFRULE_DENY == rr ? ROFF_IGN : ROFF_CONT);
+ }
+
+ /*
+ * A denied conditional must evaluate its children if and only
+ * if they're either structurally required (such as loops and
+ * conditionals) or a closing macro.
+ */
+
+ if (ROFFRULE_DENY == rr)
+ if ( ! (ROFFMAC_STRUCT & roffs[t].flags))
+ if (ROFF_ccond != t)
+ return(ROFF_IGN);
+
+ assert(roffs[t].proc);
+ return((*roffs[t].proc)(r, t, bufp, szp,
+ ln, ppos, pos, offs));
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_cond_text(ROFF_ARGS)
+{
+ char *ep;
+ enum roffrule rr;
+
+ rr = r->last->rule;
+ roffnode_cleanscope(r);
+
+ ep = &(*bufp)[pos];
+ for ( ; NULL != (ep = strchr(ep, '\\')); ep++) {
+ ep++;
+ if ('}' != *ep)
+ continue;
+ *ep = '&';
+ roff_ccond(r, ROFF_ccond, bufp, szp,
+ ln, pos, pos + 2, offs);
+ }
+ return(ROFFRULE_DENY == rr ? ROFF_IGN : ROFF_CONT);
+}
+
+static enum roffrule
+roff_evalcond(const char *v, int *pos)
+{
+
+ switch (v[*pos]) {
+ case ('n'):
+ (*pos)++;
+ return(ROFFRULE_ALLOW);
+ case ('e'):
+ /* FALLTHROUGH */
+ case ('o'):
+ /* FALLTHROUGH */
+ case ('t'):
+ (*pos)++;
+ return(ROFFRULE_DENY);
+ default:
+ break;
+ }
+
+ while (v[*pos] && ' ' != v[*pos])
+ (*pos)++;
+ return(ROFFRULE_DENY);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_line_ignore(ROFF_ARGS)
+{
+
+ if (ROFF_it == tok)
+ mandoc_msg(MANDOCERR_REQUEST, r->parse, ln, ppos, "it");
+
+ return(ROFF_IGN);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_cond(ROFF_ARGS)
+{
+
+ roffnode_push(r, tok, NULL, ln, ppos);
+
+ /*
+ * An `.el' has no conditional body: it will consume the value
+ * of the current rstack entry set in prior `ie' calls or
+ * defaults to DENY.
+ *
+ * If we're not an `el', however, then evaluate the conditional.
+ */
+
+ r->last->rule = ROFF_el == tok ?
+ (r->rstackpos < 0 ?
+ ROFFRULE_DENY : r->rstack[r->rstackpos--]) :
+ roff_evalcond(*bufp, &pos);
+
+ /*
+ * An if-else will put the NEGATION of the current evaluated
+ * conditional into the stack of rules.
+ */
+
+ if (ROFF_ie == tok) {
+ if (r->rstackpos == RSTACK_MAX - 1) {
+ mandoc_msg(MANDOCERR_MEM,
+ r->parse, ln, ppos, NULL);
+ return(ROFF_ERR);
+ }
+ r->rstack[++r->rstackpos] =
+ ROFFRULE_DENY == r->last->rule ?
+ ROFFRULE_ALLOW : ROFFRULE_DENY;
+ }
+
+ /* If the parent has false as its rule, then so do we. */
+
+ if (r->last->parent && ROFFRULE_DENY == r->last->parent->rule)
+ r->last->rule = ROFFRULE_DENY;
+
+ /*
+ * Determine scope.
+ * If there is nothing on the line after the conditional,
+ * not even whitespace, use next-line scope.
+ */
+
+ if ('\0' == (*bufp)[pos]) {
+ r->last->endspan = 2;
+ goto out;
+ }
+
+ while (' ' == (*bufp)[pos])
+ pos++;
+
+ /* An opening brace requests multiline scope. */
+
+ if ('\\' == (*bufp)[pos] && '{' == (*bufp)[pos + 1]) {
+ r->last->endspan = -1;
+ pos += 2;
+ goto out;
+ }
+
+ /*
+ * Anything else following the conditional causes
+ * single-line scope. Warn if the scope contains
+ * nothing but trailing whitespace.
+ */
+
+ if ('\0' == (*bufp)[pos])
+ mandoc_msg(MANDOCERR_NOARGS, r->parse, ln, ppos, NULL);
+
+ r->last->endspan = 1;
+
+out:
+ *offs = pos;
+ return(ROFF_RERUN);
+}
+
+
+/* ARGSUSED */
+static enum rofferr
+roff_ds(ROFF_ARGS)
+{
+ char *name, *string;
+
+ /*
+ * A symbol is named by the first word following the macro
+ * invocation up to a space. Its value is anything after the
+ * name's trailing whitespace and optional double-quote. Thus,
+ *
+ * [.ds foo "bar " ]
+ *
+ * will have `bar " ' as its value.
+ */
+
+ string = *bufp + pos;
+ name = roff_getname(r, &string, ln, pos);
+ if ('\0' == *name)
+ return(ROFF_IGN);
+
+ /* Read past initial double-quote. */
+ if ('"' == *string)
+ string++;
+
+ /* The rest is the value. */
+ roff_setstr(r, name, string, 0);
+ return(ROFF_IGN);
+}
+
+int
+roff_regisset(const struct roff *r, enum regs reg)
+{
+
+ return(r->regs[(int)reg].set);
+}
+
+unsigned int
+roff_regget(const struct roff *r, enum regs reg)
+{
+
+ return(r->regs[(int)reg].u);
+}
+
+void
+roff_regunset(struct roff *r, enum regs reg)
+{
+
+ r->regs[(int)reg].set = 0;
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_nr(ROFF_ARGS)
+{
+ const char *key;
+ char *val;
+ int iv;
+
+ val = *bufp + pos;
+ key = roff_getname(r, &val, ln, pos);
+
+ if (0 == strcmp(key, "nS")) {
+ r->regs[(int)REG_nS].set = 1;
+ if ((iv = mandoc_strntoi(val, strlen(val), 10)) >= 0)
+ r->regs[(int)REG_nS].u = (unsigned)iv;
+ else
+ r->regs[(int)REG_nS].u = 0u;
+ }
+
+ return(ROFF_IGN);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_rm(ROFF_ARGS)
+{
+ const char *name;
+ char *cp;
+
+ cp = *bufp + pos;
+ while ('\0' != *cp) {
+ name = roff_getname(r, &cp, ln, (int)(cp - *bufp));
+ if ('\0' != *name)
+ roff_setstr(r, name, NULL, 0);
+ }
+ return(ROFF_IGN);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_TE(ROFF_ARGS)
+{
+
+ if (NULL == r->tbl)
+ mandoc_msg(MANDOCERR_NOSCOPE, r->parse, ln, ppos, NULL);
+ else
+ tbl_end(&r->tbl);
+
+ return(ROFF_IGN);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_T_(ROFF_ARGS)
+{
+
+ if (NULL == r->tbl)
+ mandoc_msg(MANDOCERR_NOSCOPE, r->parse, ln, ppos, NULL);
+ else
+ tbl_restart(ppos, ln, r->tbl);
+
+ return(ROFF_IGN);
+}
+
+#if 0
+static int
+roff_closeeqn(struct roff *r)
+{
+
+ return(r->eqn && ROFF_EQN == eqn_end(&r->eqn) ? 1 : 0);
+}
+#endif
+
+static void
+roff_openeqn(struct roff *r, const char *name, int line,
+ int offs, const char *buf)
+{
+ struct eqn_node *e;
+ int poff;
+
+ assert(NULL == r->eqn);
+ e = eqn_alloc(name, offs, line, r->parse);
+
+ if (r->last_eqn)
+ r->last_eqn->next = e;
+ else
+ r->first_eqn = r->last_eqn = e;
+
+ r->eqn = r->last_eqn = e;
+
+ if (buf) {
+ poff = 0;
+ eqn_read(&r->eqn, line, buf, offs, &poff);
+ }
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_EQ(ROFF_ARGS)
+{
+
+ roff_openeqn(r, *bufp + pos, ln, ppos, NULL);
+ return(ROFF_IGN);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_EN(ROFF_ARGS)
+{
+
+ mandoc_msg(MANDOCERR_NOSCOPE, r->parse, ln, ppos, NULL);
+ return(ROFF_IGN);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_TS(ROFF_ARGS)
+{
+ struct tbl_node *t;
+
+ if (r->tbl) {
+ mandoc_msg(MANDOCERR_SCOPEBROKEN, r->parse, ln, ppos, NULL);
+ tbl_end(&r->tbl);
+ }
+
+ t = tbl_alloc(ppos, ln, r->parse);
+
+ if (r->last_tbl)
+ r->last_tbl->next = t;
+ else
+ r->first_tbl = r->last_tbl = t;
+
+ r->tbl = r->last_tbl = t;
+ return(ROFF_IGN);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_cc(ROFF_ARGS)
+{
+ const char *p;
+
+ p = *bufp + pos;
+
+ if ('\0' == *p || '.' == (r->control = *p++))
+ r->control = 0;
+
+ if ('\0' != *p)
+ mandoc_msg(MANDOCERR_ARGCOUNT, r->parse, ln, ppos, NULL);
+
+ return(ROFF_IGN);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_tr(ROFF_ARGS)
+{
+ const char *p, *first, *second;
+ size_t fsz, ssz;
+ enum mandoc_esc esc;
+
+ p = *bufp + pos;
+
+ if ('\0' == *p) {
+ mandoc_msg(MANDOCERR_ARGCOUNT, r->parse, ln, ppos, NULL);
+ return(ROFF_IGN);
+ }
+
+ while ('\0' != *p) {
+ fsz = ssz = 1;
+
+ first = p++;
+ if ('\\' == *first) {
+ esc = mandoc_escape(&p, NULL, NULL);
+ if (ESCAPE_ERROR == esc) {
+ mandoc_msg
+ (MANDOCERR_BADESCAPE, r->parse,
+ ln, (int)(p - *bufp), NULL);
+ return(ROFF_IGN);
+ }
+ fsz = (size_t)(p - first);
+ }
+
+ second = p++;
+ if ('\\' == *second) {
+ esc = mandoc_escape(&p, NULL, NULL);
+ if (ESCAPE_ERROR == esc) {
+ mandoc_msg
+ (MANDOCERR_BADESCAPE, r->parse,
+ ln, (int)(p - *bufp), NULL);
+ return(ROFF_IGN);
+ }
+ ssz = (size_t)(p - second);
+ } else if ('\0' == *second) {
+ mandoc_msg(MANDOCERR_ARGCOUNT, r->parse,
+ ln, (int)(p - *bufp), NULL);
+ second = " ";
+ p--;
+ }
+
+ if (fsz > 1) {
+ roff_setstrn(&r->xmbtab, first,
+ fsz, second, ssz, 0);
+ continue;
+ }
+
+ if (NULL == r->xtab)
+ r->xtab = mandoc_calloc
+ (128, sizeof(struct roffstr));
+
+ free(r->xtab[(int)*first].p);
+ r->xtab[(int)*first].p = mandoc_strndup(second, ssz);
+ r->xtab[(int)*first].sz = ssz;
+ }
+
+ return(ROFF_IGN);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_so(ROFF_ARGS)
+{
+ char *name;
+
+ mandoc_msg(MANDOCERR_SO, r->parse, ln, ppos, NULL);
+
+ /*
+ * Handle `so'. Be EXTREMELY careful, as we shouldn't be
+ * opening anything that's not in our cwd or anything beneath
+ * it. Thus, explicitly disallow traversing up the file-system
+ * or using absolute paths.
+ */
+
+ name = *bufp + pos;
+ if ('/' == *name || strstr(name, "../") || strstr(name, "/..")) {
+ mandoc_msg(MANDOCERR_SOPATH, r->parse, ln, pos, NULL);
+ return(ROFF_ERR);
+ }
+
+ *offs = pos;
+ return(ROFF_SO);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_userdef(ROFF_ARGS)
+{
+ const char *arg[9];
+ char *cp, *n1, *n2;
+ int i;
+
+ /*
+ * Collect pointers to macro argument strings
+ * and null-terminate them.
+ */
+ cp = *bufp + pos;
+ for (i = 0; i < 9; i++)
+ arg[i] = '\0' == *cp ? "" :
+ mandoc_getarg(r->parse, &cp, ln, &pos);
+
+ /*
+ * Expand macro arguments.
+ */
+ *szp = 0;
+ n1 = cp = mandoc_strdup(r->current_string);
+ while (NULL != (cp = strstr(cp, "\\$"))) {
+ i = cp[2] - '1';
+ if (0 > i || 8 < i) {
+ /* Not an argument invocation. */
+ cp += 2;
+ continue;
+ }
+
+ *szp = strlen(n1) - 3 + strlen(arg[i]) + 1;
+ n2 = mandoc_malloc(*szp);
+
+ strlcpy(n2, n1, (size_t)(cp - n1 + 1));
+ strlcat(n2, arg[i], *szp);
+ strlcat(n2, cp + 3, *szp);
+
+ cp = n2 + (cp - n1);
+ free(n1);
+ n1 = n2;
+ }
+
+ /*
+ * Replace the macro invocation
+ * by the expanded macro.
+ */
+ free(*bufp);
+ *bufp = n1;
+ if (0 == *szp)
+ *szp = strlen(*bufp) + 1;
+
+ return(*szp > 1 && '\n' == (*bufp)[(int)*szp - 2] ?
+ ROFF_REPARSE : ROFF_APPEND);
+}
+
+static char *
+roff_getname(struct roff *r, char **cpp, int ln, int pos)
+{
+ char *name, *cp;
+
+ name = *cpp;
+ if ('\0' == *name)
+ return(name);
+
+ /* Read until end of name. */
+ for (cp = name; '\0' != *cp && ' ' != *cp; cp++) {
+ if ('\\' != *cp)
+ continue;
+ cp++;
+ if ('\\' == *cp)
+ continue;
+ mandoc_msg(MANDOCERR_NAMESC, r->parse, ln, pos, NULL);
+ *cp = '\0';
+ name = cp;
+ }
+
+ /* Nil-terminate name. */
+ if ('\0' != *cp)
+ *(cp++) = '\0';
+
+ /* Read past spaces. */
+ while (' ' == *cp)
+ cp++;
+
+ *cpp = cp;
+ return(name);
+}
+
+/*
+ * Store *string into the user-defined string called *name.
+ * In multiline mode, append to an existing entry and append '\n';
+ * else replace the existing entry, if there is one.
+ * To clear an existing entry, call with (*r, *name, NULL, 0).
+ */
+static void
+roff_setstr(struct roff *r, const char *name, const char *string,
+ int multiline)
+{
+
+ roff_setstrn(&r->strtab, name, strlen(name), string,
+ string ? strlen(string) : 0, multiline);
+}
+
+static void
+roff_setstrn(struct roffkv **r, const char *name, size_t namesz,
+ const char *string, size_t stringsz, int multiline)
+{
+ struct roffkv *n;
+ char *c;
+ int i;
+ size_t oldch, newch;
+
+ /* Search for an existing string with the same name. */
+ n = *r;
+
+ while (n && strcmp(name, n->key.p))
+ n = n->next;
+
+ if (NULL == n) {
+ /* Create a new string table entry. */
+ n = mandoc_malloc(sizeof(struct roffkv));
+ n->key.p = mandoc_strndup(name, namesz);
+ n->key.sz = namesz;
+ n->val.p = NULL;
+ n->val.sz = 0;
+ n->next = *r;
+ *r = n;
+ } else if (0 == multiline) {
+ /* In multiline mode, append; else replace. */
+ free(n->val.p);
+ n->val.p = NULL;
+ n->val.sz = 0;
+ }
+
+ if (NULL == string)
+ return;
+
+ /*
+ * One additional byte for the '\n' in multiline mode,
+ * and one for the terminating '\0'.
+ */
+ newch = stringsz + (multiline ? 2u : 1u);
+
+ if (NULL == n->val.p) {
+ n->val.p = mandoc_malloc(newch);
+ *n->val.p = '\0';
+ oldch = 0;
+ } else {
+ oldch = n->val.sz;
+ n->val.p = mandoc_realloc(n->val.p, oldch + newch);
+ }
+
+ /* Skip existing content in the destination buffer. */
+ c = n->val.p + (int)oldch;
+
+ /* Append new content to the destination buffer. */
+ i = 0;
+ while (i < (int)stringsz) {
+ /*
+ * Rudimentary roff copy mode:
+ * Handle escaped backslashes.
+ */
+ if ('\\' == string[i] && '\\' == string[i + 1])
+ i++;
+ *c++ = string[i++];
+ }
+
+ /* Append terminating bytes. */
+ if (multiline)
+ *c++ = '\n';
+
+ *c = '\0';
+ n->val.sz = (int)(c - n->val.p);
+}
+
+static const char *
+roff_getstrn(const struct roff *r, const char *name, size_t len)
+{
+ const struct roffkv *n;
+
+ for (n = r->strtab; n; n = n->next)
+ if (0 == strncmp(name, n->key.p, len) &&
+ '\0' == n->key.p[(int)len])
+ return(n->val.p);
+
+ return(NULL);
+}
+
+static void
+roff_freestr(struct roffkv *r)
+{
+ struct roffkv *n, *nn;
+
+ for (n = r; n; n = nn) {
+ free(n->key.p);
+ free(n->val.p);
+ nn = n->next;
+ free(n);
+ }
+}
+
+const struct tbl_span *
+roff_span(const struct roff *r)
+{
+
+ return(r->tbl ? tbl_span(r->tbl) : NULL);
+}
+
+const struct eqn *
+roff_eqn(const struct roff *r)
+{
+
+ return(r->last_eqn ? &r->last_eqn->eqn : NULL);
+}
+
+/*
+ * Duplicate an input string, making the appropriate character
+ * conversations (as stipulated by `tr') along the way.
+ * Returns a heap-allocated string with all the replacements made.
+ */
+char *
+roff_strdup(const struct roff *r, const char *p)
+{
+ const struct roffkv *cp;
+ char *res;
+ const char *pp;
+ size_t ssz, sz;
+ enum mandoc_esc esc;
+
+ if (NULL == r->xmbtab && NULL == r->xtab)
+ return(mandoc_strdup(p));
+ else if ('\0' == *p)
+ return(mandoc_strdup(""));
+
+ /*
+ * Step through each character looking for term matches
+ * (remember that a `tr' can be invoked with an escape, which is
+ * a glyph but the escape is multi-character).
+ * We only do this if the character hash has been initialised
+ * and the string is >0 length.
+ */
+
+ res = NULL;
+ ssz = 0;
+
+ while ('\0' != *p) {
+ if ('\\' != *p && r->xtab && r->xtab[(int)*p].p) {
+ sz = r->xtab[(int)*p].sz;
+ res = mandoc_realloc(res, ssz + sz + 1);
+ memcpy(res + ssz, r->xtab[(int)*p].p, sz);
+ ssz += sz;
+ p++;
+ continue;
+ } else if ('\\' != *p) {
+ res = mandoc_realloc(res, ssz + 2);
+ res[ssz++] = *p++;
+ continue;
+ }
+
+ /* Search for term matches. */
+ for (cp = r->xmbtab; cp; cp = cp->next)
+ if (0 == strncmp(p, cp->key.p, cp->key.sz))
+ break;
+
+ if (NULL != cp) {
+ /*
+ * A match has been found.
+ * Append the match to the array and move
+ * forward by its keysize.
+ */
+ res = mandoc_realloc
+ (res, ssz + cp->val.sz + 1);
+ memcpy(res + ssz, cp->val.p, cp->val.sz);
+ ssz += cp->val.sz;
+ p += (int)cp->key.sz;
+ continue;
+ }
+
+ /*
+ * Handle escapes carefully: we need to copy
+ * over just the escape itself, or else we might
+ * do replacements within the escape itself.
+ * Make sure to pass along the bogus string.
+ */
+ pp = p++;
+ esc = mandoc_escape(&p, NULL, NULL);
+ if (ESCAPE_ERROR == esc) {
+ sz = strlen(pp);
+ res = mandoc_realloc(res, ssz + sz + 1);
+ memcpy(res + ssz, pp, sz);
+ break;
+ }
+ /*
+ * We bail out on bad escapes.
+ * No need to warn: we already did so when
+ * roff_res() was called.
+ */
+ sz = (int)(p - pp);
+ res = mandoc_realloc(res, ssz + sz + 1);
+ memcpy(res + ssz, pp, sz);
+ ssz += sz;
+ }
+
+ res[(int)ssz] = '\0';
+ return(res);
+}
+
+/*
+ * Find out whether a line is a macro line or not.
+ * If it is, adjust the current position and return one; if it isn't,
+ * return zero and don't change the current position.
+ * If the control character has been set with `.cc', then let that grain
+ * precedence.
+ * This is slighly contrary to groff, where using the non-breaking
+ * control character when `cc' has been invoked will cause the
+ * non-breaking macro contents to be printed verbatim.
+ */
+int
+roff_getcontrol(const struct roff *r, const char *cp, int *ppos)
+{
+ int pos;
+
+ pos = *ppos;
+
+ if (0 != r->control && cp[pos] == r->control)
+ pos++;
+ else if (0 != r->control)
+ return(0);
+ else if ('\\' == cp[pos] && '.' == cp[pos + 1])
+ pos += 2;
+ else if ('.' == cp[pos] || '\'' == cp[pos])
+ pos++;
+ else
+ return(0);
+
+ while (' ' == cp[pos] || '\t' == cp[pos])
+ pos++;
+
+ *ppos = pos;
+ return(1);