+ assert(roffs[t].proc);
+ return((*roffs[t].proc)(r, t, bufp, szp,
+ ln, ppos, pos, offs));
+}
+
+
+/* ARGSUSED */
+static enum rofferr
+roff_block_text(ROFF_ARGS)
+{
+
+ if (ROFF_de == tok)
+ roff_setstr(r, r->last->name, *bufp + pos, 2);
+
+ return(ROFF_IGN);
+}
+
+
+/* ARGSUSED */
+static enum rofferr
+roff_cond_sub(ROFF_ARGS)
+{
+ enum rofft t;
+ char *ep;
+ int rr;
+
+ rr = r->last->rule;
+ roffnode_cleanscope(r);
+ t = roff_parse(r, *bufp, &pos);
+
+ /*
+ * Fully handle known macros when they are structurally
+ * required or when the conditional evaluated to true.
+ */
+
+ if ((ROFF_MAX != t) &&
+ (rr || ROFFMAC_STRUCT & roffs[t].flags)) {
+ assert(roffs[t].proc);
+ return((*roffs[t].proc)(r, t, bufp, szp,
+ ln, ppos, pos, offs));
+ }
+
+ /*
+ * If `\}' occurs on a macro line without a preceding macro,
+ * drop the line completely.
+ */
+
+ ep = *bufp + pos;
+ if ('\\' == ep[0] && '}' == ep[1])
+ rr = 0;
+
+ /* Always check for the closing delimiter `\}'. */
+
+ while (NULL != (ep = strchr(ep, '\\'))) {
+ if ('}' == *(++ep)) {
+ *ep = '&';
+ roff_ccond(r, ln, ep - *bufp - 1);
+ }
+ ++ep;
+ }
+ return(rr ? ROFF_CONT : ROFF_IGN);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_cond_text(ROFF_ARGS)
+{
+ char *ep;
+ int rr;
+
+ rr = r->last->rule;
+ roffnode_cleanscope(r);
+
+ ep = *bufp + pos;
+ while (NULL != (ep = strchr(ep, '\\'))) {
+ if ('}' == *(++ep)) {
+ *ep = '&';
+ roff_ccond(r, ln, ep - *bufp - 1);
+ }
+ ++ep;
+ }
+ return(rr ? ROFF_CONT : ROFF_IGN);
+}
+
+/*
+ * Parse a single signed integer number. Stop at the first non-digit.
+ * If there is at least one digit, return success and advance the
+ * parse point, else return failure and let the parse point unchanged.
+ * Ignore overflows, treat them just like the C language.
+ */
+static int
+roff_getnum(const char *v, int *pos, int *res)
+{
+ int p, n;
+
+ p = *pos;
+ n = v[p] == '-';
+ if (n)
+ p++;
+
+ for (*res = 0; isdigit((unsigned char)v[p]); p++)
+ *res = 10 * *res + v[p] - '0';
+ if (p == *pos + n)
+ return 0;
+
+ if (n)
+ *res = -*res;
+
+ *pos = p;
+ return 1;
+}
+
+/*
+ * Evaluate a string comparison condition.
+ * The first character is the delimiter.
+ * Succeed if the string up to its second occurrence
+ * matches the string up to its third occurence.
+ * Advance the cursor after the third occurrence
+ * or lacking that, to the end of the line.
+ */
+static int
+roff_evalstrcond(const char *v, int *pos)
+{
+ const char *s1, *s2, *s3;
+ int match;
+
+ match = 0;
+ s1 = v + *pos; /* initial delimiter */
+ s2 = s1 + 1; /* for scanning the first string */
+ s3 = strchr(s2, *s1); /* for scanning the second string */
+
+ if (NULL == s3) /* found no middle delimiter */
+ goto out;
+
+ while ('\0' != *++s3) {
+ if (*s2 != *s3) { /* mismatch */
+ s3 = strchr(s3, *s1);
+ break;
+ }
+ if (*s3 == *s1) { /* found the final delimiter */
+ match = 1;
+ break;
+ }
+ s2++;
+ }
+
+out:
+ if (NULL == s3)
+ s3 = strchr(s2, '\0');
+ else
+ s3++;
+ *pos = s3 - v;
+ return(match);
+}
+
+/*
+ * Evaluate an optionally negated single character, numerical,
+ * or string condition.
+ */
+static int
+roff_evalcond(const char *v, int *pos)
+{
+ int wanttrue, number;
+
+ if ('!' == v[*pos]) {
+ wanttrue = 0;
+ (*pos)++;
+ } else
+ wanttrue = 1;
+
+ switch (v[*pos]) {
+ case ('n'):
+ /* FALLTHROUGH */
+ case ('o'):
+ (*pos)++;
+ return(wanttrue);
+ case ('c'):
+ /* FALLTHROUGH */
+ case ('d'):
+ /* FALLTHROUGH */
+ case ('e'):
+ /* FALLTHROUGH */
+ case ('r'):
+ /* FALLTHROUGH */
+ case ('t'):
+ (*pos)++;
+ return(!wanttrue);
+ default:
+ break;
+ }
+
+ if (roff_evalnum(v, pos, &number, 0))
+ return((number > 0) == wanttrue);
+ else
+ return(roff_evalstrcond(v, pos) == wanttrue);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_line_ignore(ROFF_ARGS)
+{
+
+ return(ROFF_IGN);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_cond(ROFF_ARGS)
+{
+
+ roffnode_push(r, tok, NULL, ln, ppos);
+
+ /*
+ * An `.el' has no conditional body: it will consume the value
+ * of the current rstack entry set in prior `ie' calls or
+ * defaults to DENY.
+ *
+ * If we're not an `el', however, then evaluate the conditional.
+ */
+
+ r->last->rule = ROFF_el == tok ?
+ (r->rstackpos < 0 ? 0 : r->rstack[r->rstackpos--]) :
+ roff_evalcond(*bufp, &pos);
+
+ /*
+ * An if-else will put the NEGATION of the current evaluated
+ * conditional into the stack of rules.
+ */
+
+ if (ROFF_ie == tok) {
+ if (r->rstackpos == RSTACK_MAX - 1) {
+ mandoc_msg(MANDOCERR_MEM,
+ r->parse, ln, ppos, NULL);
+ return(ROFF_ERR);
+ }
+ r->rstack[++r->rstackpos] = !r->last->rule;
+ }
+
+ /* If the parent has false as its rule, then so do we. */
+
+ if (r->last->parent && !r->last->parent->rule)
+ r->last->rule = 0;
+
+ /*
+ * Determine scope.
+ * If there is nothing on the line after the conditional,
+ * not even whitespace, use next-line scope.
+ */
+
+ if ('\0' == (*bufp)[pos]) {
+ r->last->endspan = 2;
+ goto out;
+ }
+
+ while (' ' == (*bufp)[pos])
+ pos++;
+
+ /* An opening brace requests multiline scope. */
+
+ if ('\\' == (*bufp)[pos] && '{' == (*bufp)[pos + 1]) {
+ r->last->endspan = -1;
+ pos += 2;
+ goto out;
+ }
+
+ /*
+ * Anything else following the conditional causes
+ * single-line scope. Warn if the scope contains
+ * nothing but trailing whitespace.
+ */
+
+ if ('\0' == (*bufp)[pos])
+ mandoc_msg(MANDOCERR_NOARGS, r->parse, ln, ppos, NULL);
+
+ r->last->endspan = 1;
+
+out:
+ *offs = pos;
+ return(ROFF_RERUN);
+}
+
+
+/* ARGSUSED */
+static enum rofferr
+roff_ds(ROFF_ARGS)
+{
+ char *name, *string;
+
+ /*
+ * A symbol is named by the first word following the macro
+ * invocation up to a space. Its value is anything after the
+ * name's trailing whitespace and optional double-quote. Thus,
+ *
+ * [.ds foo "bar " ]
+ *
+ * will have `bar " ' as its value.
+ */
+
+ string = *bufp + pos;
+ name = roff_getname(r, &string, ln, pos);
+ if ('\0' == *name)
+ return(ROFF_IGN);
+
+ /* Read past initial double-quote. */
+ if ('"' == *string)
+ string++;
+
+ /* The rest is the value. */
+ roff_setstr(r, name, string, ROFF_as == tok);
+ return(ROFF_IGN);
+}
+
+/*
+ * Parse a single operator, one or two characters long.
+ * If the operator is recognized, return success and advance the
+ * parse point, else return failure and let the parse point unchanged.
+ */
+static int
+roff_getop(const char *v, int *pos, char *res)
+{
+
+ *res = v[*pos];
+
+ switch (*res) {
+ case ('+'):
+ /* FALLTHROUGH */
+ case ('-'):
+ /* FALLTHROUGH */
+ case ('*'):
+ /* FALLTHROUGH */
+ case ('/'):
+ /* FALLTHROUGH */
+ case ('%'):
+ /* FALLTHROUGH */
+ case ('&'):
+ /* FALLTHROUGH */
+ case (':'):
+ break;
+ case '<':
+ switch (v[*pos + 1]) {
+ case ('='):
+ *res = 'l';
+ (*pos)++;
+ break;
+ case ('>'):
+ *res = '!';
+ (*pos)++;
+ break;
+ case ('?'):
+ *res = 'i';
+ (*pos)++;
+ break;
+ default:
+ break;
+ }
+ break;
+ case '>':
+ switch (v[*pos + 1]) {
+ case ('='):
+ *res = 'g';
+ (*pos)++;
+ break;
+ case ('?'):
+ *res = 'a';
+ (*pos)++;
+ break;
+ default:
+ break;
+ }
+ break;
+ case '=':
+ if ('=' == v[*pos + 1])
+ (*pos)++;
+ break;
+ default:
+ return(0);
+ }
+ (*pos)++;
+
+ return(*res);
+}
+
+/*
+ * Evaluate either a parenthesized numeric expression
+ * or a single signed integer number.
+ */
+static int
+roff_evalpar(const char *v, int *pos, int *res)
+{
+
+ if ('(' != v[*pos])
+ return(roff_getnum(v, pos, res));
+
+ (*pos)++;
+ if ( ! roff_evalnum(v, pos, res, 1))
+ return(0);
+
+ /* If the trailing parenthesis is missing, ignore the error. */
+ if (')' == v[*pos])
+ (*pos)++;
+
+ return(1);
+}
+
+/*
+ * Evaluate a complete numeric expression.
+ * Proceed left to right, there is no concept of precedence.
+ */
+static int
+roff_evalnum(const char *v, int *pos, int *res, int skipwhite)
+{
+ int mypos, operand2;
+ char operator;
+
+ if (NULL == pos) {
+ mypos = 0;
+ pos = &mypos;
+ }
+
+ if (skipwhite)
+ while (isspace((unsigned char)v[*pos]))
+ (*pos)++;
+
+ if ( ! roff_evalpar(v, pos, res))
+ return(0);
+
+ while (1) {
+ if (skipwhite)
+ while (isspace((unsigned char)v[*pos]))
+ (*pos)++;
+
+ if ( ! roff_getop(v, pos, &operator))
+ break;
+
+ if (skipwhite)
+ while (isspace((unsigned char)v[*pos]))
+ (*pos)++;
+
+ if ( ! roff_evalpar(v, pos, &operand2))
+ return(0);
+
+ if (skipwhite)
+ while (isspace((unsigned char)v[*pos]))
+ (*pos)++;
+
+ switch (operator) {
+ case ('+'):
+ *res += operand2;
+ break;
+ case ('-'):
+ *res -= operand2;
+ break;
+ case ('*'):
+ *res *= operand2;
+ break;
+ case ('/'):
+ *res /= operand2;
+ break;
+ case ('%'):
+ *res %= operand2;
+ break;
+ case ('<'):
+ *res = *res < operand2;
+ break;
+ case ('>'):
+ *res = *res > operand2;
+ break;
+ case ('l'):
+ *res = *res <= operand2;
+ break;
+ case ('g'):
+ *res = *res >= operand2;
+ break;
+ case ('='):
+ *res = *res == operand2;
+ break;
+ case ('!'):
+ *res = *res != operand2;
+ break;
+ case ('&'):
+ *res = *res && operand2;
+ break;
+ case (':'):
+ *res = *res || operand2;
+ break;
+ case ('i'):
+ if (operand2 < *res)
+ *res = operand2;
+ break;
+ case ('a'):
+ if (operand2 > *res)
+ *res = operand2;
+ break;
+ default:
+ abort();
+ }
+ }
+ return(1);
+}
+
+void
+roff_setreg(struct roff *r, const char *name, int val, char sign)
+{
+ struct roffreg *reg;
+
+ /* Search for an existing register with the same name. */
+ reg = r->regtab;
+
+ while (reg && strcmp(name, reg->key.p))
+ reg = reg->next;
+
+ if (NULL == reg) {
+ /* Create a new register. */
+ reg = mandoc_malloc(sizeof(struct roffreg));
+ reg->key.p = mandoc_strdup(name);
+ reg->key.sz = strlen(name);
+ reg->val = 0;
+ reg->next = r->regtab;
+ r->regtab = reg;
+ }
+
+ if ('+' == sign)
+ reg->val += val;
+ else if ('-' == sign)
+ reg->val -= val;
+ else
+ reg->val = val;
+}
+
+/*
+ * Handle some predefined read-only number registers.
+ * For now, return -1 if the requested register is not predefined;
+ * in case a predefined read-only register having the value -1
+ * were to turn up, another special value would have to be chosen.
+ */
+static int
+roff_getregro(const char *name)
+{
+
+ switch (*name) {
+ case ('A'): /* ASCII approximation mode is always off. */
+ return(0);
+ case ('g'): /* Groff compatibility mode is always on. */
+ return(1);
+ case ('H'): /* Fixed horizontal resolution. */
+ return (24);
+ case ('j'): /* Always adjust left margin only. */
+ return(0);
+ case ('T'): /* Some output device is always defined. */
+ return(1);
+ case ('V'): /* Fixed vertical resolution. */
+ return (40);
+ default:
+ return (-1);
+ }
+}
+
+int
+roff_getreg(const struct roff *r, const char *name)
+{
+ struct roffreg *reg;
+ int val;
+
+ if ('.' == name[0] && '\0' != name[1] && '\0' == name[2]) {
+ val = roff_getregro(name + 1);
+ if (-1 != val)
+ return (val);
+ }
+
+ for (reg = r->regtab; reg; reg = reg->next)
+ if (0 == strcmp(name, reg->key.p))
+ return(reg->val);
+
+ return(0);
+}
+
+static int
+roff_getregn(const struct roff *r, const char *name, size_t len)
+{
+ struct roffreg *reg;
+ int val;
+
+ if ('.' == name[0] && 2 == len) {
+ val = roff_getregro(name + 1);
+ if (-1 != val)
+ return (val);
+ }
+
+ for (reg = r->regtab; reg; reg = reg->next)
+ if (len == reg->key.sz &&
+ 0 == strncmp(name, reg->key.p, len))
+ return(reg->val);
+
+ return(0);
+}
+
+static void
+roff_freereg(struct roffreg *reg)
+{
+ struct roffreg *old_reg;
+
+ while (NULL != reg) {
+ free(reg->key.p);
+ old_reg = reg;
+ reg = reg->next;
+ free(old_reg);
+ }
+}
+
+static enum rofferr
+roff_nr(ROFF_ARGS)
+{
+ const char *key;
+ char *val;
+ int iv;
+ char sign;
+
+ val = *bufp + pos;
+ key = roff_getname(r, &val, ln, pos);
+
+ sign = *val;
+ if ('+' == sign || '-' == sign)
+ val++;
+
+ if (roff_evalnum(val, NULL, &iv, 0))
+ roff_setreg(r, key, iv, sign);
+
+ return(ROFF_IGN);
+}
+
+static enum rofferr
+roff_rr(ROFF_ARGS)
+{
+ struct roffreg *reg, **prev;
+ const char *name;
+ char *cp;
+
+ cp = *bufp + pos;
+ name = roff_getname(r, &cp, ln, pos);
+
+ prev = &r->regtab;
+ while (1) {
+ reg = *prev;
+ if (NULL == reg || !strcmp(name, reg->key.p))
+ break;
+ prev = ®->next;
+ }
+ if (NULL != reg) {
+ *prev = reg->next;
+ free(reg->key.p);
+ free(reg);
+ }
+ return(ROFF_IGN);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_rm(ROFF_ARGS)
+{
+ const char *name;
+ char *cp;
+
+ cp = *bufp + pos;
+ while ('\0' != *cp) {
+ name = roff_getname(r, &cp, ln, (int)(cp - *bufp));
+ if ('\0' != *name)
+ roff_setstr(r, name, NULL, 0);
+ }
+ return(ROFF_IGN);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_it(ROFF_ARGS)
+{
+ char *cp;
+ size_t len;
+ int iv;
+
+ /* Parse the number of lines. */
+ cp = *bufp + pos;
+ len = strcspn(cp, " \t");
+ cp[len] = '\0';
+ if ((iv = mandoc_strntoi(cp, len, 10)) <= 0) {
+ mandoc_msg(MANDOCERR_NUMERIC, r->parse,
+ ln, ppos, *bufp + 1);
+ return(ROFF_IGN);
+ }
+ cp += len + 1;
+
+ /* Arm the input line trap. */
+ roffit_lines = iv;
+ roffit_macro = mandoc_strdup(cp);
+ return(ROFF_IGN);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_Dd(ROFF_ARGS)
+{
+ const char *const *cp;
+
+ if (0 == ((MPARSE_MDOC | MPARSE_QUICK) & r->options))
+ for (cp = __mdoc_reserved; *cp; cp++)
+ roff_setstr(r, *cp, NULL, 0);
+
+ return(ROFF_CONT);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_TH(ROFF_ARGS)
+{
+ const char *const *cp;
+
+ if (0 == (MPARSE_QUICK & r->options))
+ for (cp = __man_reserved; *cp; cp++)
+ roff_setstr(r, *cp, NULL, 0);
+
+ return(ROFF_CONT);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_TE(ROFF_ARGS)
+{
+
+ if (NULL == r->tbl)
+ mandoc_msg(MANDOCERR_NOSCOPE, r->parse, ln, ppos, NULL);
+ else
+ tbl_end(&r->tbl);
+
+ return(ROFF_IGN);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_T_(ROFF_ARGS)
+{
+
+ if (NULL == r->tbl)
+ mandoc_msg(MANDOCERR_NOSCOPE, r->parse, ln, ppos, NULL);
+ else
+ tbl_restart(ppos, ln, r->tbl);
+
+ return(ROFF_IGN);
+}
+
+#if 0
+static int
+roff_closeeqn(struct roff *r)
+{
+
+ return(r->eqn && ROFF_EQN == eqn_end(&r->eqn) ? 1 : 0);
+}
+#endif
+
+static void
+roff_openeqn(struct roff *r, const char *name, int line,
+ int offs, const char *buf)
+{
+ struct eqn_node *e;
+ int poff;
+
+ assert(NULL == r->eqn);
+ e = eqn_alloc(name, offs, line, r->parse);
+
+ if (r->last_eqn)
+ r->last_eqn->next = e;
+ else
+ r->first_eqn = r->last_eqn = e;
+
+ r->eqn = r->last_eqn = e;
+
+ if (buf) {
+ poff = 0;
+ eqn_read(&r->eqn, line, buf, offs, &poff);
+ }
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_EQ(ROFF_ARGS)
+{
+
+ roff_openeqn(r, *bufp + pos, ln, ppos, NULL);
+ return(ROFF_IGN);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_EN(ROFF_ARGS)
+{
+
+ mandoc_msg(MANDOCERR_NOSCOPE, r->parse, ln, ppos, NULL);
+ return(ROFF_IGN);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_TS(ROFF_ARGS)
+{
+ struct tbl_node *tbl;
+
+ if (r->tbl) {
+ mandoc_msg(MANDOCERR_SCOPEBROKEN, r->parse, ln, ppos, NULL);
+ tbl_end(&r->tbl);
+ }
+
+ tbl = tbl_alloc(ppos, ln, r->parse);
+
+ if (r->last_tbl)
+ r->last_tbl->next = tbl;
+ else
+ r->first_tbl = r->last_tbl = tbl;
+
+ r->tbl = r->last_tbl = tbl;
+ return(ROFF_IGN);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_cc(ROFF_ARGS)
+{
+ const char *p;
+
+ p = *bufp + pos;
+
+ if ('\0' == *p || '.' == (r->control = *p++))
+ r->control = 0;
+
+ if ('\0' != *p)
+ mandoc_msg(MANDOCERR_ARGCOUNT, r->parse, ln, ppos, NULL);
+
+ return(ROFF_IGN);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_tr(ROFF_ARGS)
+{
+ const char *p, *first, *second;
+ size_t fsz, ssz;
+ enum mandoc_esc esc;
+
+ p = *bufp + pos;
+
+ if ('\0' == *p) {
+ mandoc_msg(MANDOCERR_ARGCOUNT, r->parse, ln, ppos, NULL);
+ return(ROFF_IGN);
+ }
+
+ while ('\0' != *p) {
+ fsz = ssz = 1;
+
+ first = p++;
+ if ('\\' == *first) {
+ esc = mandoc_escape(&p, NULL, NULL);
+ if (ESCAPE_ERROR == esc) {
+ mandoc_msg
+ (MANDOCERR_BADESCAPE, r->parse,
+ ln, (int)(p - *bufp), NULL);
+ return(ROFF_IGN);
+ }
+ fsz = (size_t)(p - first);
+ }
+
+ second = p++;
+ if ('\\' == *second) {
+ esc = mandoc_escape(&p, NULL, NULL);
+ if (ESCAPE_ERROR == esc) {
+ mandoc_msg
+ (MANDOCERR_BADESCAPE, r->parse,
+ ln, (int)(p - *bufp), NULL);
+ return(ROFF_IGN);
+ }
+ ssz = (size_t)(p - second);
+ } else if ('\0' == *second) {
+ mandoc_msg(MANDOCERR_ARGCOUNT, r->parse,
+ ln, (int)(p - *bufp), NULL);
+ second = " ";
+ p--;
+ }
+
+ if (fsz > 1) {
+ roff_setstrn(&r->xmbtab, first,
+ fsz, second, ssz, 0);
+ continue;
+ }
+
+ if (NULL == r->xtab)
+ r->xtab = mandoc_calloc
+ (128, sizeof(struct roffstr));
+
+ free(r->xtab[(int)*first].p);
+ r->xtab[(int)*first].p = mandoc_strndup(second, ssz);
+ r->xtab[(int)*first].sz = ssz;
+ }
+
+ return(ROFF_IGN);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_so(ROFF_ARGS)
+{
+ char *name;
+
+ mandoc_msg(MANDOCERR_SO, r->parse, ln, ppos, NULL);
+
+ /*
+ * Handle `so'. Be EXTREMELY careful, as we shouldn't be
+ * opening anything that's not in our cwd or anything beneath
+ * it. Thus, explicitly disallow traversing up the file-system
+ * or using absolute paths.
+ */
+
+ name = *bufp + pos;
+ if ('/' == *name || strstr(name, "../") || strstr(name, "/..")) {
+ mandoc_msg(MANDOCERR_SOPATH, r->parse, ln, pos, NULL);
+ return(ROFF_ERR);
+ }
+
+ *offs = pos;
+ return(ROFF_SO);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_userdef(ROFF_ARGS)
+{
+ const char *arg[9];
+ char *cp, *n1, *n2;
+ int i;
+
+ /*
+ * Collect pointers to macro argument strings
+ * and NUL-terminate them.
+ */
+ cp = *bufp + pos;
+ for (i = 0; i < 9; i++)
+ arg[i] = '\0' == *cp ? "" :
+ mandoc_getarg(r->parse, &cp, ln, &pos);
+
+ /*
+ * Expand macro arguments.
+ */
+ *szp = 0;
+ n1 = cp = mandoc_strdup(r->current_string);
+ while (NULL != (cp = strstr(cp, "\\$"))) {
+ i = cp[2] - '1';
+ if (0 > i || 8 < i) {
+ /* Not an argument invocation. */
+ cp += 2;
+ continue;
+ }
+
+ *szp = strlen(n1) - 3 + strlen(arg[i]) + 1;
+ n2 = mandoc_malloc(*szp);
+
+ strlcpy(n2, n1, (size_t)(cp - n1 + 1));
+ strlcat(n2, arg[i], *szp);
+ strlcat(n2, cp + 3, *szp);
+
+ cp = n2 + (cp - n1);
+ free(n1);
+ n1 = n2;
+ }
+
+ /*
+ * Replace the macro invocation
+ * by the expanded macro.
+ */
+ free(*bufp);
+ *bufp = n1;
+ if (0 == *szp)
+ *szp = strlen(*bufp) + 1;
+
+ return(*szp > 1 && '\n' == (*bufp)[(int)*szp - 2] ?
+ ROFF_REPARSE : ROFF_APPEND);
+}
+
+static char *
+roff_getname(struct roff *r, char **cpp, int ln, int pos)
+{
+ char *name, *cp;
+
+ name = *cpp;
+ if ('\0' == *name)
+ return(name);
+
+ /* Read until end of name. */
+ for (cp = name; '\0' != *cp && ' ' != *cp; cp++) {
+ if ('\\' != *cp)
+ continue;
+ cp++;
+ if ('\\' == *cp)
+ continue;
+ mandoc_msg(MANDOCERR_NAMESC, r->parse, ln, pos, NULL);
+ *cp = '\0';
+ name = cp;
+ }
+
+ /* Nil-terminate name. */
+ if ('\0' != *cp)
+ *(cp++) = '\0';
+
+ /* Read past spaces. */
+ while (' ' == *cp)
+ cp++;
+
+ *cpp = cp;
+ return(name);
+}
+
+/*
+ * Store *string into the user-defined string called *name.
+ * To clear an existing entry, call with (*r, *name, NULL, 0).
+ * append == 0: replace mode
+ * append == 1: single-line append mode
+ * append == 2: multiline append mode, append '\n' after each call
+ */
+static void
+roff_setstr(struct roff *r, const char *name, const char *string,
+ int append)
+{
+
+ roff_setstrn(&r->strtab, name, strlen(name), string,
+ string ? strlen(string) : 0, append);
+}
+
+static void
+roff_setstrn(struct roffkv **r, const char *name, size_t namesz,
+ const char *string, size_t stringsz, int append)
+{
+ struct roffkv *n;
+ char *c;
+ int i;
+ size_t oldch, newch;
+
+ /* Search for an existing string with the same name. */
+ n = *r;
+
+ while (n && strcmp(name, n->key.p))
+ n = n->next;
+
+ if (NULL == n) {
+ /* Create a new string table entry. */
+ n = mandoc_malloc(sizeof(struct roffkv));
+ n->key.p = mandoc_strndup(name, namesz);
+ n->key.sz = namesz;
+ n->val.p = NULL;
+ n->val.sz = 0;
+ n->next = *r;
+ *r = n;
+ } else if (0 == append) {
+ free(n->val.p);
+ n->val.p = NULL;
+ n->val.sz = 0;
+ }
+
+ if (NULL == string)
+ return;
+
+ /*
+ * One additional byte for the '\n' in multiline mode,
+ * and one for the terminating '\0'.
+ */
+ newch = stringsz + (1 < append ? 2u : 1u);
+
+ if (NULL == n->val.p) {
+ n->val.p = mandoc_malloc(newch);
+ *n->val.p = '\0';
+ oldch = 0;
+ } else {
+ oldch = n->val.sz;
+ n->val.p = mandoc_realloc(n->val.p, oldch + newch);
+ }
+
+ /* Skip existing content in the destination buffer. */
+ c = n->val.p + (int)oldch;
+
+ /* Append new content to the destination buffer. */
+ i = 0;
+ while (i < (int)stringsz) {
+ /*
+ * Rudimentary roff copy mode:
+ * Handle escaped backslashes.
+ */
+ if ('\\' == string[i] && '\\' == string[i + 1])
+ i++;
+ *c++ = string[i++];
+ }
+
+ /* Append terminating bytes. */
+ if (1 < append)
+ *c++ = '\n';
+
+ *c = '\0';
+ n->val.sz = (int)(c - n->val.p);
+}
+
+static const char *
+roff_getstrn(const struct roff *r, const char *name, size_t len)
+{
+ const struct roffkv *n;
+ int i;
+
+ for (n = r->strtab; n; n = n->next)
+ if (0 == strncmp(name, n->key.p, len) &&
+ '\0' == n->key.p[(int)len])
+ return(n->val.p);
+
+ for (i = 0; i < PREDEFS_MAX; i++)
+ if (0 == strncmp(name, predefs[i].name, len) &&
+ '\0' == predefs[i].name[(int)len])
+ return(predefs[i].str);
+
+ return(NULL);
+}
+
+static void
+roff_freestr(struct roffkv *r)
+{
+ struct roffkv *n, *nn;
+
+ for (n = r; n; n = nn) {
+ free(n->key.p);
+ free(n->val.p);
+ nn = n->next;
+ free(n);
+ }
+}
+
+const struct tbl_span *
+roff_span(const struct roff *r)
+{
+
+ return(r->tbl ? tbl_span(r->tbl) : NULL);
+}
+
+const struct eqn *
+roff_eqn(const struct roff *r)
+{
+
+ return(r->last_eqn ? &r->last_eqn->eqn : NULL);
+}
+
+/*
+ * Duplicate an input string, making the appropriate character
+ * conversations (as stipulated by `tr') along the way.
+ * Returns a heap-allocated string with all the replacements made.
+ */
+char *
+roff_strdup(const struct roff *r, const char *p)
+{
+ const struct roffkv *cp;
+ char *res;
+ const char *pp;
+ size_t ssz, sz;
+ enum mandoc_esc esc;
+
+ if (NULL == r->xmbtab && NULL == r->xtab)
+ return(mandoc_strdup(p));
+ else if ('\0' == *p)
+ return(mandoc_strdup(""));
+
+ /*
+ * Step through each character looking for term matches
+ * (remember that a `tr' can be invoked with an escape, which is
+ * a glyph but the escape is multi-character).
+ * We only do this if the character hash has been initialised
+ * and the string is >0 length.
+ */
+
+ res = NULL;
+ ssz = 0;
+
+ while ('\0' != *p) {
+ if ('\\' != *p && r->xtab && r->xtab[(int)*p].p) {
+ sz = r->xtab[(int)*p].sz;
+ res = mandoc_realloc(res, ssz + sz + 1);
+ memcpy(res + ssz, r->xtab[(int)*p].p, sz);
+ ssz += sz;
+ p++;
+ continue;
+ } else if ('\\' != *p) {
+ res = mandoc_realloc(res, ssz + 2);
+ res[ssz++] = *p++;
+ continue;
+ }
+
+ /* Search for term matches. */
+ for (cp = r->xmbtab; cp; cp = cp->next)
+ if (0 == strncmp(p, cp->key.p, cp->key.sz))
+ break;
+
+ if (NULL != cp) {
+ /*
+ * A match has been found.
+ * Append the match to the array and move
+ * forward by its keysize.
+ */
+ res = mandoc_realloc
+ (res, ssz + cp->val.sz + 1);
+ memcpy(res + ssz, cp->val.p, cp->val.sz);
+ ssz += cp->val.sz;
+ p += (int)cp->key.sz;
+ continue;
+ }
+
+ /*
+ * Handle escapes carefully: we need to copy
+ * over just the escape itself, or else we might
+ * do replacements within the escape itself.
+ * Make sure to pass along the bogus string.
+ */
+ pp = p++;
+ esc = mandoc_escape(&p, NULL, NULL);
+ if (ESCAPE_ERROR == esc) {
+ sz = strlen(pp);
+ res = mandoc_realloc(res, ssz + sz + 1);
+ memcpy(res + ssz, pp, sz);
+ break;
+ }
+ /*
+ * We bail out on bad escapes.
+ * No need to warn: we already did so when
+ * roff_res() was called.
+ */
+ sz = (int)(p - pp);
+ res = mandoc_realloc(res, ssz + sz + 1);
+ memcpy(res + ssz, pp, sz);
+ ssz += sz;
+ }
+
+ res[(int)ssz] = '\0';
+ return(res);
+}
+
+/*
+ * Find out whether a line is a macro line or not.
+ * If it is, adjust the current position and return one; if it isn't,
+ * return zero and don't change the current position.
+ * If the control character has been set with `.cc', then let that grain
+ * precedence.
+ * This is slighly contrary to groff, where using the non-breaking
+ * control character when `cc' has been invoked will cause the
+ * non-breaking macro contents to be printed verbatim.
+ */
+int
+roff_getcontrol(const struct roff *r, const char *cp, int *ppos)
+{
+ int pos;
+
+ pos = *ppos;
+
+ if (0 != r->control && cp[pos] == r->control)
+ pos++;
+ else if (0 != r->control)
+ return(0);
+ else if ('\\' == cp[pos] && '.' == cp[pos + 1])
+ pos += 2;
+ else if ('.' == cp[pos] || '\'' == cp[pos])
+ pos++;
+ else
+ return(0);
+
+ while (' ' == cp[pos] || '\t' == cp[pos])
+ pos++;
+
+ *ppos = pos;
+ return(1);