Fix three bugs regarding the interaction of \z and \h:

1. The combination \z\h is a no-op whatever the argument may be.
In the past, the \z only affected the first space character generated
by the \h, which was wrong.

2. For the conbination \zX\h with a positive argument, the first
space resulting from the \h is not printed but consumed by the \z.

3. For the combination \zX\h with a negative argument, application
of the \z needs to be completed before the \h can be started.
In the past, if this combination occurred at the beginning of an
output line, the \h backed up to the beginning of the line and
after that, the \z attempted to back up even further, triggering
an assertion.

Bugs found during an audit of assignments to termp->col that i
started after the bugfix tbl_term.c rev. 1.65.  The assertion
triggered by bug 3 was *not* yet found by afl(1).

1 files changed, 18 insertions, 4 deletions

diff --git a/term.c b/term.c
index 70ca20c4..b7c2363f 100644
--- a/term.c
+++ b/term.c
@@ -1,4 +1,4 @@
-/* $Id: term.c,v 1.285 2022/01/10 18:01:35 schwarze Exp $ */
+/* $Id: term.c,v 1.286 2022/04/27 13:41:13 schwarze Exp $ */
 /*
  * Copyright (c) 2010-2022 Ingo Schwarze <schwarze@openbsd.org>
  * Copyright (c) 2008, 2009, 2010, 2011 Kristaps Dzonsons <kristaps@bsd.lv>
@@ -628,6 +628,10 @@ term_word(struct termp *p, const char *word)
 				encode(p, "utf8", 4);
 			continue;
 		case ESCAPE_HORIZ:
+			if (p->flags & TERMP_BACKAFTER) {
+				p->flags &= ~TERMP_BACKAFTER;
+				continue;
+			}
 			if (*seq == '|') {
 				seq++;
 				uc = -p->col;
@@ -636,12 +640,22 @@ term_word(struct termp *p, const char *word)
 			if (a2roffsu(seq, &su, SCALE_EM) == NULL)
 				continue;
 			uc += term_hen(p, &su);
-			if (uc > 0) {
+			if (uc >= 0) {
 				while (uc > 0) {
-					bufferc(p, ASCII_NBRSP);
 					uc -= term_len(p, 1);
+					if (p->flags & TERMP_BACKBEFORE)
+						p->flags &= ~TERMP_BACKBEFORE;
+					else
+						bufferc(p, ASCII_NBRSP);
 				}
-			} else if (p->col > (size_t)(-uc)) {
+				continue;
+			}
+			if (p->flags & TERMP_BACKBEFORE) {
+				p->flags &= ~TERMP_BACKBEFORE;
+				assert(p->col > 0);
+				p->col--;
+			}
+			if (p->col >= (size_t)(-uc)) {
 				p->col += uc;
 			} else {
 				uc += p->col;