Surprisingly, groff supports multiple copy mode escapes at the

beginning of an escape sequence: \, \E, \EE, \EEE, and so on all do
the same outside copy mode, so let them do the same in mandoc(1), too.

This fixes an assertion failure triggered by \EE*X that tb@ found
with afl(1).  The first E was consumed by roff_expand(), but that
function failed to recognize the escape sequence as the expansion
of a user-defined string and handed it over to mandoc_escape(),
which consumed the second E and then died on an assertion because
it is not prepared to handle user-defined strings.  Fix this by
letting *both* functions handle arbitrary numbers of 'E's correctly.

5 files changed, 56 insertions, 8 deletions

diff --git a/mandoc.c b/mandoc.c
index 6adf1a43..92d18665 100644
--- a/mandoc.c
+++ b/mandoc.c
@@ -1,7 +1,7 @@
-/*	$Id: mandoc.c,v 1.119 2021/08/10 12:55:03 schwarze Exp $ */
+/* $Id: mandoc.c,v 1.120 2022/04/13 13:19:34 schwarze Exp $ */
 /*
+ * Copyright (c) 2011-2015, 2017-2022 Ingo Schwarze <schwarze@openbsd.org>
  * Copyright (c) 2008-2011, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
- * Copyright (c) 2011-2015, 2017-2021 Ingo Schwarze <schwarze@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -114,7 +114,7 @@ mandoc_escape(const char **end, const char **start, int *sz)
 	 * it only makes a difference in copy mode.
 	 */
 
-	if (**end == 'E')
+	while (**end == 'E')
 		++*end;
 
 	/*
diff --git a/regress/roff/esc/E1.in b/regress/roff/esc/E1.in
new file mode 100644
index 00000000..4a74350e
--- /dev/null
+++ b/regress/roff/esc/E1.in
@@ -0,0 +1,27 @@
+.\" $OpenBSD: E1.in,v 1.1 2022/04/13 13:11:33 schwarze Exp $
+.Dd $Mdocdate: April 13 2022 $
+.Dt ESC-E 1
+.Os
+.Sh NAME
+.Nm esc-E
+.Nd copy-mode escaping of backslashes
+.Sh DESCRIPTION
+.ds myvar myval
+.nr myreg 1 1
+initial text
+.Pp
+string expansion: \*[myvar] \E*[myvar] \EE*[myvar] \EEE*[myvar]
+.Pp
+output device: \*(.T \E*[.T] \EE*(.T \EEE*(.T
+.Pp
+numerical expression test: \B'1' \EB'X' \EEB'2' \EEEB'Y'
+.Pp
+register:
+\n[myreg]
+\En+[myreg]
+\EEn+[myreg]
+\EEEn[myreg]
+.Pp
+special character: \(<= \E(>= \EE(<< \EEE(>>
+.Pp
+final text
diff --git a/regress/roff/esc/E1.out_ascii b/regress/roff/esc/E1.out_ascii
new file mode 100644
index 00000000..1c4dbe14
--- /dev/null
+++ b/regress/roff/esc/E1.out_ascii
@@ -0,0 +1,21 @@
+ESC-E(1)                    General Commands Manual                   ESC-E(1)
+
+NNAAMMEE
+     eesscc--EE - copy-mode escaping of backslashes
+
+DDEESSCCRRIIPPTTIIOONN
+     initial text
+
+     string expansion: myval myval myval myval
+
+     output device: ascii ascii ascii ascii
+
+     numerical expression test: 1 0 1 0
+
+     register: 1 2 3 3
+
+     special character: <= >= << >>
+
+     final text
+
+OpenBSD                         April 13, 2022                         OpenBSD
diff --git a/regress/roff/esc/Makefile b/regress/roff/esc/Makefile
index 8c4fdaba..4c152fc4 100644
--- a/regress/roff/esc/Makefile
+++ b/regress/roff/esc/Makefile
@@ -1,6 +1,6 @@
-# $OpenBSD: Makefile,v 1.17 2020/12/21 14:55:58 schwarze Exp $
+# $OpenBSD: Makefile,v 1.18 2022/04/13 13:11:33 schwarze Exp $
 
-REGRESS_TARGETS	 = one two multi B bs_man bs_mdoc c c_man e f h l O1 o p w z
+REGRESS_TARGETS	 = one two multi B bs_man bs_mdoc c c_man E1 e f h l O1 o p w z
 REGRESS_TARGETS	+= ignore invalid unsupp
 HTML_TARGETS	 = f
 LINT_TARGETS	 = B h l O1 w ignore invalid unsupp
diff --git a/roff.c b/roff.c
index d60eca96..bd222d56 100644
--- a/roff.c
+++ b/roff.c
@@ -1,6 +1,6 @@
-/* $Id: roff.c,v 1.380 2021/10/04 14:19:14 schwarze Exp $ */
+/* $Id: roff.c,v 1.381 2022/04/13 13:19:34 schwarze Exp $ */
 /*
- * Copyright (c) 2010-2015, 2017-2021 Ingo Schwarze <schwarze@openbsd.org>
+ * Copyright (c) 2010-2015, 2017-2022 Ingo Schwarze <schwarze@openbsd.org>
  * Copyright (c) 2008-2012, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -1401,7 +1401,7 @@ roff_expand(struct roff *r, struct buf *buf, int ln, int pos, char newesc)
 
 		term = '\0';
 		cp = stesc + 1;
-		if (*cp == 'E')
+		while (*cp == 'E')
 			cp++;
 		esct = cp;
 		switch (*esct) {