/usr/src/usr.bin/mandoc/roff.c

Bug Summary

File:	src/usr.bin/mandoc/roff.c
Warning:	line 1114, column 3 Use of memory after it is freed
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name roff.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.bin/mandoc/obj -resource-dir /usr/local/llvm16/lib/clang/16 -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -Wno-unused-parameter -fdebug-compilation-dir=/usr/src/usr.bin/mandoc/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/usr.bin/mandoc/roff.c
1/* $OpenBSD: roff.c,v 1.272 2023/10/24 20:30:49 schwarze Exp $ */
2/*
* Copyright (c) 2010-2015, 2017-2023 Ingo Schwarze <schwarze@openbsd.org>
* Copyright (c) 2008-2012, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHORS DISCLAIM ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*
* Implementation of the roff(7) parser for mandoc(1).
*/
20#include <sys/types.h>

22#include <assert.h>
23#include <ctype.h>
24#include <limits.h>
25#include <stddef.h>
26#include <stdint.h>
27#include <stdio.h>
28#include <stdlib.h>
29#include <string.h>

31#include "mandoc_aux.h"
32#include "mandoc_ohash.h"
33#include "mandoc.h"
34#include "roff.h"
35#include "mandoc_parse.h"
36#include "libmandoc.h"
37#include "roff_int.h"
38#include "tbl_parse.h"
39#include "eqn_parse.h"

41/* Maximum number of string expansions per line, to break infinite loops. */
42#define	EXPAND_LIMIT1000	1000

44/* Types of definitions of macros and strings. */
45#define	ROFFDEF_USER(1 << 1)	(1 << 1)  /* User-defined. */
46#define	ROFFDEF_PRE(1 << 2)	(1 << 2)  /* Predefined. */
47#define	ROFFDEF_REN(1 << 3)	(1 << 3)  /* Renamed standard macro. */
48#define	ROFFDEF_STD(1 << 4)	(1 << 4)  /* mdoc(7) or man(7) macro. */
49#define	ROFFDEF_ANY((1 << 1) | (1 << 2) | (1 << 3) | (1 <<
 4))	(ROFFDEF_USER(1 << 1) | ROFFDEF_PRE(1 << 2) | \
	 ROFFDEF_REN(1 << 3) | ROFFDEF_STD(1 << 4))
51#define	ROFFDEF_UNDEF(1 << 5)	(1 << 5)  /* Completely undefined. */

53/* --- data types --------------------------------------------------------- */

55/*
* An incredibly-simple string buffer.
*/
58struct	roffstr {
char		*p; /* nil-terminated buffer */
size_t		 sz; /* saved strlen(p) */
61};

63/*
* A key-value roffstr pair as part of a singly-linked list.
*/
66struct	roffkv {
struct roffstr	 key;
struct roffstr	 val;
struct roffkv	*next; /* next in list */
70};

72/*
* A single number register as part of a singly-linked list.
*/
75struct	roffreg {
struct roffstr	 key;
int		 val;
int		 step;
struct roffreg	*next;
80};

82/*
* Association of request and macro names with token IDs.
*/
85struct	roffreq {
enum roff_tok	 tok;
char		 name[];
88};

90/*
* A macro processing context.
* More than one is needed when macro calls are nested.
*/
94struct	mctx {
char		**argv;
int		 argc;
int		 argsz;
98};

100struct	roff {
struct roff_man	*man; /* mdoc or man parser */
struct roffnode	*last; /* leaf of stack */
struct mctx	*mstack; /* stack of macro contexts */
int		*rstack; /* stack of inverted `ie' values */
struct ohash	*reqtab; /* request lookup table */
struct roffreg	*regtab; /* number registers */
struct roffkv	*strtab; /* user-defined strings & macros */
struct roffkv	*rentab; /* renamed strings & macros */
struct roffkv	*xmbtab; /* multi-byte trans table (`tr') */
struct roffstr	*xtab; /* single-byte trans table (`tr') */
const char	*current_string; /* value of last called user macro */
struct tbl_node	*first_tbl; /* first table parsed */
struct tbl_node	*last_tbl; /* last table parsed */
struct tbl_node	*tbl; /* current table being parsed */
struct eqn_node	*last_eqn; /* equation parser */
struct eqn_node	*eqn; /* active equation parser */
int		 eqn_inline; /* current equation is inline */
int		 options; /* parse options */
int		 mstacksz; /* current size of mstack */
int		 mstackpos; /* position in mstack */
int		 rstacksz; /* current size limit of rstack */
int		 rstackpos; /* position in rstack */
int		 format; /* current file in mdoc or man format */
char		 control; /* control character */
char		 escape; /* escape character */
126};

128/*
* A macro definition, condition, or ignored block.
*/
131struct	roffnode {
enum roff_tok	 tok; /* type of node */
struct roffnode	*parent; /* up one in stack */
int		 line; /* parse line */
int		 col; /* parse col */
char		*name; /* node name, e.g. macro name */
char		*end; /* custom end macro of the block */
int		 endspan; /* scope to: 1=eol 2=next line -1=\} */
int		 rule; /* content is: 1=evaluated 0=skipped */
140};

142#define	ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs	 struct roff *r, /* parse ctx */ \
	 enum roff_tok tok, /* tok of macro */ \
	 struct buf *buf, /* input buffer */ \
	 int ln, /* parse line */ \
	 int ppos, /* original pos in buffer */ \
	 int pos, /* current pos in buffer */ \
	 int *offs /* reset offset of buffer data */

150typedef	int (*roffproc)(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);

152struct	roffmac {
roffproc	 proc; /* process new macro */
roffproc	 text; /* process as child text of macro */
roffproc	 sub; /* process as child of macro */
int		 flags;
157#define	ROFFMAC_STRUCT(1 << 0)	(1 << 0) /* always interpret */
158};

160struct	predef {
const char	*name; /* predefined input name */
const char	*str; /* replacement symbol */
163};

165#define	PREDEF(__name, __str){ (__name), (__str) }, \
{ (__name), (__str) },

168/* --- function prototypes ------------------------------------------------ */

170static	int		 roffnode_cleanscope(struct roff *);
171static	int		 roffnode_pop(struct roff *);
172static	void		 roffnode_push(struct roff *, enum roff_tok,
		const char *, int, int);
174static	void		 roff_addtbl(struct roff_man *, int, struct tbl_node *);
175static	int		 roff_als(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
176static	int		 roff_block(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
177static	int		 roff_block_text(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
178static	int		 roff_block_sub(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
179static	int		 roff_break(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
180static	int		 roff_cblock(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
181static	int		 roff_cc(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
182static	int		 roff_ccond(struct roff *, int, int);
183static	int		 roff_char(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
184static	int		 roff_cond(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
185static	int		 roff_cond_checkend(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
186static	int		 roff_cond_text(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
187static	int		 roff_cond_sub(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
188static	int		 roff_ds(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
189static	int		 roff_ec(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
190static	int		 roff_eo(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
191static	int		 roff_eqndelim(struct roff *, struct buf *, int);
192static	int		 roff_evalcond(struct roff *, int, char *, int *);
193static	int		 roff_evalnum(struct roff *, int,
		const char *, int *, int *, int);
195static	int		 roff_evalpar(struct roff *, int,
		const char *, int *, int *, int);
197static	int		 roff_evalstrcond(const char *, int *);
198static	int		 roff_expand(struct roff *, struct buf *,
		int, int, char);
200static	void		 roff_expand_patch(struct buf *, int,
		const char *, int);
202static	void		 roff_free1(struct roff *);
203static	void		 roff_freereg(struct roffreg *);
204static	void		 roff_freestr(struct roffkv *);
205static	size_t		 roff_getname(struct roff *, char **, int, int);
206static	int		 roff_getnum(const char *, int *, int *, int);
207static	int		 roff_getop(const char *, int *, char *);
208static	int		 roff_getregn(struct roff *,
		const char *, size_t, char);
210static	int		 roff_getregro(const struct roff *,
		const char *name);
212static	const char	*roff_getstrn(struct roff *,
		const char *, size_t, int *);
214static	int		 roff_hasregn(const struct roff *,
		const char *, size_t);
216static	int		 roff_insec(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
217static	int		 roff_it(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
218static	int		 roff_line_ignore(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
219static	void		 roff_man_alloc1(struct roff_man *);
220static	void		 roff_man_free1(struct roff_man *);
221static	int		 roff_manyarg(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
222static	int		 roff_mc(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
223static	int		 roff_noarg(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
224static	int		 roff_nop(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
225static	int		 roff_nr(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
226static	int		 roff_onearg(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
227static	enum roff_tok	 roff_parse(struct roff *, char *, int *,
		int, int);
229static	int		 roff_parse_comment(struct roff *, struct buf *,
		int, int, char);
231static	int		 roff_parsetext(struct roff *, struct buf *,
		int, int *);
233static	int		 roff_renamed(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
234static	int		 roff_req_or_macro(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
235static	int		 roff_return(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
236static	int		 roff_rm(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
237static	int		 roff_rn(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
238static	int		 roff_rr(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
239static	void		 roff_setregn(struct roff *, const char *,
		size_t, int, char, int);
241static	void		 roff_setstr(struct roff *,
		const char *, const char *, int);
243static	void		 roff_setstrn(struct roffkv **, const char *,
		size_t, const char *, size_t, int);
245static	int		 roff_shift(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
246static	int		 roff_so(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
247static	int		 roff_tr(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
248static	int		 roff_Dd(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
249static	int		 roff_TE(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
250static	int		 roff_TS(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
251static	int		 roff_EQ(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
252static	int		 roff_EN(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
253static	int		 roff_T_(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
254static	int		 roff_unsupp(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);
255static	int		 roff_userdef(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs);

257/* --- constant data ------------------------------------------------------ */

259#define	ROFFNUM_SCALE(1 << 0)	(1 << 0)  /* Honour scaling in roff_getnum(). */
260#define	ROFFNUM_WHITE(1 << 1)	(1 << 1)  /* Skip whitespace in roff_evalnum(). */

262const char *__roff_name[MAN_MAX + 1] = {
"br",		"ce",		"fi",		"ft",
"ll",		"mc",		"nf",
"po",		"rj",		"sp",
"ta",		"ti",		NULL((void *)0),
"ab",		"ad",		"af",		"aln",
"als",		"am",		"am1",		"ami",
"ami1",		"as",		"as1",		"asciify",
"backtrace",	"bd",		"bleedat",	"blm",
      "box",		"boxa",		"bp",		"BP",
"break",	"breakchar",	"brnl",		"brp",
"brpnl",	"c2",		"cc",
"cf",		"cflags",	"ch",		"char",
"chop",		"class",	"close",	"CL",
"color",	"composite",	"continue",	"cp",
"cropat",	"cs",		"cu",		"da",
"dch",		"Dd",		"de",		"de1",
"defcolor",	"dei",		"dei1",		"device",
"devicem",	"di",		"do",		"ds",
"ds1",		"dwh",		"dt",		"ec",
"ecr",		"ecs",		"el",		"em",
"EN",		"eo",		"EP",		"EQ",
"errprint",	"ev",		"evc",		"ex",
"fallback",	"fam",		"fc",		"fchar",
"fcolor",	"fdeferlig",	"feature",	"fkern",
"fl",		"flig",		"fp",		"fps",
"fschar",	"fspacewidth",	"fspecial",	"ftr",
"fzoom",	"gcolor",	"hc",		"hcode",
"hidechar",	"hla",		"hlm",		"hpf",
"hpfa",		"hpfcode",	"hw",		"hy",
"hylang",	"hylen",	"hym",		"hypp",
"hys",		"ie",		"if",		"ig",
"index",	"it",		"itc",		"IX",
"kern",		"kernafter",	"kernbefore",	"kernpair",
"lc",		"lc_ctype",	"lds",		"length",
"letadj",	"lf",		"lg",		"lhang",
"linetabs",	"lnr",		"lnrf",		"lpfx",
"ls",		"lsm",		"lt",
"mediasize",	"minss",	"mk",		"mso",
"na",		"ne",		"nh",		"nhychar",
"nm",		"nn",		"nop",		"nr",
"nrf",		"nroff",	"ns",		"nx",
"open",		"opena",	"os",		"output",
"padj",		"papersize",	"pc",		"pev",
"pi",		"PI",		"pl",		"pm",
"pn",		"pnr",		"ps",
"psbb",		"pshape",	"pso",		"ptr",
"pvs",		"rchar",	"rd",		"recursionlimit",
"return",	"rfschar",	"rhang",
"rm",		"rn",		"rnn",		"rr",
"rs",		"rt",		"schar",	"sentchar",
"shc",		"shift",	"sizes",	"so",
"spacewidth",	"special",	"spreadwarn",	"ss",
"sty",		"substring",	"sv",		"sy",
"T&",		"tc",		"TE",
"TH",		"tkf",		"tl",
"tm",		"tm1",		"tmc",		"tr",
"track",	"transchar",	"trf",		"trimat",
"trin",		"trnt",		"troff",	"TS",
"uf",		"ul",		"unformat",	"unwatch",
"unwatchn",	"vpt",		"vs",		"warn",
"warnscale",	"watch",	"watchlength",	"watchn",
"wh",		"while",	"write",	"writec",
"writem",	"xflag",	".",		NULL((void *)0),
NULL((void *)0),		"text",
"Dd",		"Dt",		"Os",		"Sh",
"Ss",		"Pp",		"D1",		"Dl",
"Bd",		"Ed",		"Bl",		"El",
"It",		"Ad",		"An",		"Ap",
"Ar",		"Cd",		"Cm",		"Dv",
"Er",		"Ev",		"Ex",		"Fa",
"Fd",		"Fl",		"Fn",		"Ft",
"Ic",		"In",		"Li",		"Nd",
"Nm",		"Op",		"Ot",		"Pa",
"Rv",		"St",		"Va",		"Vt",
"Xr",		"%A",		"%B",		"%D",
"%I",		"%J",		"%N",		"%O",
"%P",		"%R",		"%T",		"%V",
"Ac",		"Ao",		"Aq",		"At",
"Bc",		"Bf",		"Bo",		"Bq",
"Bsx",		"Bx",		"Db",		"Dc",
"Do",		"Dq",		"Ec",		"Ef",
"Em",		"Eo",		"Fx",		"Ms",
"No",		"Ns",		"Nx",		"Ox",
"Pc",		"Pf",		"Po",		"Pq",
"Qc",		"Ql",		"Qo",		"Qq",
"Re",		"Rs",		"Sc",		"So",
"Sq",		"Sm",		"Sx",		"Sy",
"Tn",		"Ux",		"Xc",		"Xo",
"Fo",		"Fc",		"Oo",		"Oc",
"Bk",		"Ek",		"Bt",		"Hf",
"Fr",		"Ud",		"Lb",		"Lp",
"Lk",		"Mt",		"Brq",		"Bro",
"Brc",		"%C",		"Es",		"En",
"Dx",		"%Q",		"%U",		"Ta",
"Tg",		NULL((void *)0),
"TH",		"SH",		"SS",		"TP",
"TQ",
"LP",		"PP",		"P",		"IP",
"HP",		"SM",		"SB",		"BI",
"IB",		"BR",		"RB",		"R",
"B",		"I",		"IR",		"RI",
"RE",		"RS",		"DT",		"UC",
"PD",		"AT",		"in",
"SY",		"YS",		"OP",
"EX",		"EE",		"UR",
"UE",		"MT",		"ME",		"MR",
NULL((void *)0)
370};
371const	char *const *roff_name = __roff_name;

373static	struct roffmac	 roffs[TOKEN_NONE] = {
{ roff_noarg, NULL((void *)0), NULL((void *)0), 0 },  /* br */
{ roff_onearg, NULL((void *)0), NULL((void *)0), 0 },  /* ce */
{ roff_noarg, NULL((void *)0), NULL((void *)0), 0 },  /* fi */
{ roff_onearg, NULL((void *)0), NULL((void *)0), 0 },  /* ft */
{ roff_onearg, NULL((void *)0), NULL((void *)0), 0 },  /* ll */
{ roff_mc, NULL((void *)0), NULL((void *)0), 0 },  /* mc */
{ roff_noarg, NULL((void *)0), NULL((void *)0), 0 },  /* nf */
{ roff_onearg, NULL((void *)0), NULL((void *)0), 0 },  /* po */
{ roff_onearg, NULL((void *)0), NULL((void *)0), 0 },  /* rj */
{ roff_onearg, NULL((void *)0), NULL((void *)0), 0 },  /* sp */
{ roff_manyarg, NULL((void *)0), NULL((void *)0), 0 },  /* ta */
{ roff_onearg, NULL((void *)0), NULL((void *)0), 0 },  /* ti */
{ NULL((void *)0), NULL((void *)0), NULL((void *)0), 0 },  /* ROFF_MAX */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* ab */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* ad */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* af */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* aln */
{ roff_als, NULL((void *)0), NULL((void *)0), 0 },  /* als */
{ roff_block, roff_block_text, roff_block_sub, 0 },  /* am */
{ roff_block, roff_block_text, roff_block_sub, 0 },  /* am1 */
{ roff_block, roff_block_text, roff_block_sub, 0 },  /* ami */
{ roff_block, roff_block_text, roff_block_sub, 0 },  /* ami1 */
{ roff_ds, NULL((void *)0), NULL((void *)0), 0 },  /* as */
{ roff_ds, NULL((void *)0), NULL((void *)0), 0 },  /* as1 */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* asciify */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* backtrace */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* bd */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* bleedat */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* blm */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* box */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* boxa */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* bp */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* BP */
{ roff_break, NULL((void *)0), NULL((void *)0), 0 },  /* break */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* breakchar */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* brnl */
{ roff_noarg, NULL((void *)0), NULL((void *)0), 0 },  /* brp */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* brpnl */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* c2 */
{ roff_cc, NULL((void *)0), NULL((void *)0), 0 },  /* cc */
{ roff_insec, NULL((void *)0), NULL((void *)0), 0 },  /* cf */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* cflags */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* ch */
{ roff_char, NULL((void *)0), NULL((void *)0), 0 },  /* char */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* chop */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* class */
{ roff_insec, NULL((void *)0), NULL((void *)0), 0 },  /* close */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* CL */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* color */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* composite */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* continue */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* cp */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* cropat */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* cs */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* cu */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* da */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* dch */
{ roff_Dd, NULL((void *)0), NULL((void *)0), 0 },  /* Dd */
{ roff_block, roff_block_text, roff_block_sub, 0 },  /* de */
{ roff_block, roff_block_text, roff_block_sub, 0 },  /* de1 */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* defcolor */
{ roff_block, roff_block_text, roff_block_sub, 0 },  /* dei */
{ roff_block, roff_block_text, roff_block_sub, 0 },  /* dei1 */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* device */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* devicem */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* di */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* do */
{ roff_ds, NULL((void *)0), NULL((void *)0), 0 },  /* ds */
{ roff_ds, NULL((void *)0), NULL((void *)0), 0 },  /* ds1 */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* dwh */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* dt */
{ roff_ec, NULL((void *)0), NULL((void *)0), 0 },  /* ec */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* ecr */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* ecs */
{ roff_cond, roff_cond_text, roff_cond_sub, ROFFMAC_STRUCT(1 << 0) },  /* el */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* em */
{ roff_EN, NULL((void *)0), NULL((void *)0), 0 },  /* EN */
{ roff_eo, NULL((void *)0), NULL((void *)0), 0 },  /* eo */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* EP */
{ roff_EQ, NULL((void *)0), NULL((void *)0), 0 },  /* EQ */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* errprint */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* ev */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* evc */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* ex */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* fallback */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* fam */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* fc */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* fchar */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* fcolor */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* fdeferlig */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* feature */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* fkern */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* fl */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* flig */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* fp */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* fps */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* fschar */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* fspacewidth */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* fspecial */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* ftr */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* fzoom */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* gcolor */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* hc */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* hcode */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* hidechar */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* hla */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* hlm */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* hpf */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* hpfa */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* hpfcode */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* hw */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* hy */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* hylang */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* hylen */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* hym */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* hypp */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* hys */
{ roff_cond, roff_cond_text, roff_cond_sub, ROFFMAC_STRUCT(1 << 0) },  /* ie */
{ roff_cond, roff_cond_text, roff_cond_sub, ROFFMAC_STRUCT(1 << 0) },  /* if */
{ roff_block, roff_block_text, roff_block_sub, 0 },  /* ig */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* index */
{ roff_it, NULL((void *)0), NULL((void *)0), 0 },  /* it */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* itc */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* IX */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* kern */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* kernafter */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* kernbefore */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* kernpair */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* lc */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* lc_ctype */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* lds */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* length */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* letadj */
{ roff_insec, NULL((void *)0), NULL((void *)0), 0 },  /* lf */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* lg */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* lhang */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* linetabs */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* lnr */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* lnrf */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* lpfx */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* ls */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* lsm */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* lt */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* mediasize */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* minss */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* mk */
{ roff_insec, NULL((void *)0), NULL((void *)0), 0 },  /* mso */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* na */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* ne */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* nh */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* nhychar */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* nm */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* nn */
{ roff_nop, NULL((void *)0), NULL((void *)0), 0 },  /* nop */
{ roff_nr, NULL((void *)0), NULL((void *)0), 0 },  /* nr */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* nrf */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* nroff */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* ns */
{ roff_insec, NULL((void *)0), NULL((void *)0), 0 },  /* nx */
{ roff_insec, NULL((void *)0), NULL((void *)0), 0 },  /* open */
{ roff_insec, NULL((void *)0), NULL((void *)0), 0 },  /* opena */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* os */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* output */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* padj */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* papersize */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* pc */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* pev */
{ roff_insec, NULL((void *)0), NULL((void *)0), 0 },  /* pi */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* PI */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* pl */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* pm */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* pn */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* pnr */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* ps */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* psbb */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* pshape */
{ roff_insec, NULL((void *)0), NULL((void *)0), 0 },  /* pso */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* ptr */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* pvs */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* rchar */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* rd */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* recursionlimit */
{ roff_return, NULL((void *)0), NULL((void *)0), 0 },  /* return */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* rfschar */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* rhang */
{ roff_rm, NULL((void *)0), NULL((void *)0), 0 },  /* rm */
{ roff_rn, NULL((void *)0), NULL((void *)0), 0 },  /* rn */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* rnn */
{ roff_rr, NULL((void *)0), NULL((void *)0), 0 },  /* rr */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* rs */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* rt */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* schar */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* sentchar */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* shc */
{ roff_shift, NULL((void *)0), NULL((void *)0), 0 },  /* shift */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* sizes */
{ roff_so, NULL((void *)0), NULL((void *)0), 0 },  /* so */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* spacewidth */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* special */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* spreadwarn */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* ss */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* sty */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* substring */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* sv */
{ roff_insec, NULL((void *)0), NULL((void *)0), 0 },  /* sy */
{ roff_T_, NULL((void *)0), NULL((void *)0), 0 },  /* T& */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* tc */
{ roff_TE, NULL((void *)0), NULL((void *)0), 0 },  /* TE */
{ roff_Dd, NULL((void *)0), NULL((void *)0), 0 },  /* TH */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* tkf */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* tl */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* tm */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* tm1 */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* tmc */
{ roff_tr, NULL((void *)0), NULL((void *)0), 0 },  /* tr */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* track */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* transchar */
{ roff_insec, NULL((void *)0), NULL((void *)0), 0 },  /* trf */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* trimat */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* trin */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* trnt */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* troff */
{ roff_TS, NULL((void *)0), NULL((void *)0), 0 },  /* TS */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* uf */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* ul */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* unformat */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* unwatch */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* unwatchn */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* vpt */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* vs */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* warn */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* warnscale */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* watch */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* watchlength */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* watchn */
{ roff_unsupp, NULL((void *)0), NULL((void *)0), 0 },  /* wh */
{ roff_cond, roff_cond_text, roff_cond_sub, ROFFMAC_STRUCT(1 << 0) }, /*while*/
{ roff_insec, NULL((void *)0), NULL((void *)0), 0 },  /* write */
{ roff_insec, NULL((void *)0), NULL((void *)0), 0 },  /* writec */
{ roff_insec, NULL((void *)0), NULL((void *)0), 0 },  /* writem */
{ roff_line_ignore, NULL((void *)0), NULL((void *)0), 0 },  /* xflag */
{ roff_cblock, NULL((void *)0), NULL((void *)0), 0 },  /* . */
{ roff_renamed, NULL((void *)0), NULL((void *)0), 0 },
{ roff_userdef, NULL((void *)0), NULL((void *)0), 0 }
618};

620/* Array of injected predefined strings. */
621#define	PREDEFS_MAX38	 38
622static	const struct predef predefs[PREDEFS_MAX38] = {
623#include "predefs.in"
624};

626static	int	 roffce_lines;	/* number of input lines to center */
627static	struct roff_node *roffce_node;  /* active request */
628static	int	 roffit_lines;  /* number of lines to delay */
629static	char	*roffit_macro;  /* nil-terminated macro line */


632/* --- request table ------------------------------------------------------ */

634struct ohash *
635roffhash_alloc(enum roff_tok mintok, enum roff_tok maxtok)
636{
struct ohash	*htab;
struct roffreq	*req;
enum roff_tok	 tok;
size_t		 sz;
unsigned int	 slot;

htab = mandoc_malloc(sizeof(*htab));
mandoc_ohash_init(htab, 8, offsetof(struct roffreq, name)__builtin_offsetof(struct roffreq, name));

for (tok = mintok; tok < maxtok; tok++) {
if (roff_name[tok] == NULL((void *)0))
	continue;
sz = strlen(roff_name[tok]);
req = mandoc_malloc(sizeof(*req) + sz + 1);
req->tok = tok;
memcpy(req->name, roff_name[tok], sz + 1);
slot = ohash_qlookup(htab, req->name);
ohash_insert(htab, slot, req);
}
return htab;
657}

659void
660roffhash_free(struct ohash *htab)
661{
struct roffreq	*req;
unsigned int	 slot;

if (htab == NULL((void *)0))
return;
for (req = ohash_first(htab, &slot); req != NULL((void *)0);
    req = ohash_next(htab, &slot))
free(req);
ohash_delete(htab);
free(htab);
672}

674enum roff_tok
675roffhash_find(struct ohash *htab, const char *name, size_t sz)
676{
struct roffreq	*req;
const char	*end;

if (sz) {
end = name + sz;
req = ohash_find(htab, ohash_qlookupi(htab, name, &end));
} else
req = ohash_find(htab, ohash_qlookup(htab, name));
return req == NULL((void *)0) ? TOKEN_NONE : req->tok;
686}

688/* --- stack of request blocks -------------------------------------------- */

690/*
* Pop the current node off of the stack of roff instructions currently
* pending.  Return 1 if it is a loop or 0 otherwise.
*/
694static int
695roffnode_pop(struct roff *r)
696{
struct roffnode	*p;
int		 inloop;

p = r->last;
inloop = p->tok == ROFF_while;
r->last = p->parent;
free(p->name);
free(p->end);
free(p);
return inloop;
707}

709/*
* Push a roff node onto the instruction stack.  This must later be
* removed with roffnode_pop().
*/
713static void
714roffnode_push(struct roff *r, enum roff_tok tok, const char *name,
int line, int col)
716{
struct roffnode	*p;

p = mandoc_calloc(1, sizeof(struct roffnode));
p->tok = tok;
if (name)
p->name = mandoc_strdup(name);
p->parent = r->last;
p->line = line;
p->col = col;
p->rule = p->parent ? p->parent->rule : 0;

r->last = p;
729}

731/* --- roff parser state data management ---------------------------------- */

733static void
734roff_free1(struct roff *r)
735{
int		 i;

tbl_free(r->first_tbl);
r->first_tbl = r->last_tbl = r->tbl = NULL((void *)0);

eqn_free(r->last_eqn);
r->last_eqn = r->eqn = NULL((void *)0);

while (r->mstackpos >= 0)
roff_userret(r);

while (r->last)
roffnode_pop(r);

free (r->rstack);
r->rstack = NULL((void *)0);
r->rstacksz = 0;
r->rstackpos = -1;

roff_freereg(r->regtab);
r->regtab = NULL((void *)0);

roff_freestr(r->strtab);
roff_freestr(r->rentab);
roff_freestr(r->xmbtab);
r->strtab = r->rentab = r->xmbtab = NULL((void *)0);

if (r->xtab)
for (i = 0; i < 128; i++)
	free(r->xtab[i].p);
free(r->xtab);
r->xtab = NULL((void *)0);
768}

770void
771roff_reset(struct roff *r)
772{
roff_free1(r);
r->options |= MPARSE_COMMENT(1 << 7);
r->format = r->options & (MPARSE_MDOC(1 << 0) | MPARSE_MAN(1 << 1));
r->control = '\0';
r->escape = '\\';
roffce_lines = 0;
roffce_node = NULL((void *)0);
roffit_lines = 0;
roffit_macro = NULL((void *)0);
782}

784void
785roff_free(struct roff *r)
786{
int		 i;

roff_free1(r);
for (i = 0; i < r->mstacksz; i++)
free(r->mstack[i].argv);
free(r->mstack);
roffhash_free(r->reqtab);
free(r);
795}

797struct roff *
798roff_alloc(int options)
799{
struct roff	*r;

r = mandoc_calloc(1, sizeof(struct roff));
r->reqtab = roffhash_alloc(0, ROFF_RENAMED);
r->options = options | MPARSE_COMMENT(1 << 7);
r->format = options & (MPARSE_MDOC(1 << 0) | MPARSE_MAN(1 << 1));
r->mstackpos = -1;
r->rstackpos = -1;
r->escape = '\\';
return r;
810}

812/* --- syntax tree state data management ---------------------------------- */

814static void
815roff_man_free1(struct roff_man *man)
816{
if (man->meta.first != NULL((void *)0))
2
←
Assuming field 'first' is not equal to NULL→
3
←
Taking true branch→
roff_node_delete(man, man->meta.first);
4
←
Calling 'roff_node_delete'→
free(man->meta.msec);
free(man->meta.vol);
free(man->meta.os);
free(man->meta.arch);
free(man->meta.title);
free(man->meta.name);
free(man->meta.date);
free(man->meta.sodest);
827}

829void
830roff_state_reset(struct roff_man *man)
831{
man->last = man->meta.first;
man->last_es = NULL((void *)0);
man->flags = 0;
man->lastsec = man->lastnamed = SEC_NONE;
man->next = ROFF_NEXT_CHILD;
roff_setreg(man->roff, "nS", 0, '=');
838}

840static void
841roff_man_alloc1(struct roff_man *man)
842{
memset(&man->meta, 0, sizeof(man->meta));
man->meta.first = mandoc_calloc(1, sizeof(*man->meta.first));
man->meta.first->type = ROFFT_ROOT;
man->meta.macroset = MACROSET_NONE;
roff_state_reset(man);
848}

850void
851roff_man_reset(struct roff_man *man)
852{
roff_man_free1(man);
roff_man_alloc1(man);
855}

857void
858roff_man_free(struct roff_man *man)
859{
roff_man_free1(man);
1
Calling 'roff_man_free1'→
free(man->os_r);
free(man);
863}

865struct roff_man *
866roff_man_alloc(struct roff *roff, const char *os_s, int quick)
867{
struct roff_man *man;

man = mandoc_calloc(1, sizeof(*man));
man->roff = roff;
man->os_s = os_s;
man->quick = quick;
roff_man_alloc1(man);
roff->man = man;
return man;
877}

879/* --- syntax tree handling ----------------------------------------------- */

881struct roff_node *
882roff_node_alloc(struct roff_man *man, int line, int pos,
enum roff_type type, int tok)
884{
struct roff_node	*n;

n = mandoc_calloc(1, sizeof(*n));
n->line = line;
n->pos = pos;
n->tok = tok;
n->type = type;
n->sec = man->lastsec;

if (man->flags & MDOC_SYNOPSIS(1 << 7))
n->flags |= NODE_SYNPRETTY(1 << 7);
else
n->flags &= ~NODE_SYNPRETTY(1 << 7);
if ((man->flags & (ROFF_NOFILL(1 << 1) | ROFF_NONOFILL(1 << 16))) == ROFF_NOFILL(1 << 1))
n->flags |= NODE_NOFILL(1 << 8);
else
n->flags &= ~NODE_NOFILL(1 << 8);
if (man->flags & MDOC_NEWLINE(1 << 3))
n->flags |= NODE_LINE(1 << 3);
man->flags &= ~MDOC_NEWLINE(1 << 3);

return n;
907}

909void
910roff_node_append(struct roff_man *man, struct roff_node *n)
911{

switch (man->next) {
case ROFF_NEXT_SIBLING:
if (man->last->next != NULL((void *)0)) {
	n->next = man->last->next;
	man->last->next->prev = n;
} else
	man->last->parent->last = n;
man->last->next = n;
n->prev = man->last;
n->parent = man->last->parent;
break;
case ROFF_NEXT_CHILD:
if (man->last->child != NULL((void *)0)) {
	n->next = man->last->child;
	man->last->child->prev = n;
} else
	man->last->last = n;
man->last->child = n;
n->parent = man->last;
break;
default:
abort();
}
man->last = n;

switch (n->type) {
case ROFFT_HEAD:
n->parent->head = n;
break;
case ROFFT_BODY:
if (n->end != ENDBODY_NOT)
	return;
n->parent->body = n;
break;
case ROFFT_TAIL:
n->parent->tail = n;
break;
default:
return;
}

/*
* Copy over the normalised-data pointer of our parent.  Not
* everybody has one, but copying a null pointer is fine.
*/

n->norm = n->parent->norm;
assert(n->parent->type == ROFFT_BLOCK)((n->parent->type == ROFFT_BLOCK) ? (void)0 : __assert2
("/usr/src/usr.bin/mandoc/roff.c", 960, __func__, "n->parent->type == ROFFT_BLOCK"
));
961}

963void
964roff_word_alloc(struct roff_man *man, int line, int pos, const char *word)
965{
struct roff_node	*n;

n = roff_node_alloc(man, line, pos, ROFFT_TEXT, TOKEN_NONE);
n->string = roff_strdup(man->roff, word);
roff_node_append(man, n);
n->flags |= NODE_VALID(1 << 0) | NODE_ENDED(1 << 1);
man->next = ROFF_NEXT_SIBLING;
973}

975void
976roff_word_append(struct roff_man *man, const char *word)
977{
struct roff_node	*n;
char			*addstr, *newstr;

n = man->last;
addstr = roff_strdup(man->roff, word);
mandoc_asprintf(&newstr, "%s %s", n->string, addstr);
free(addstr);
free(n->string);
n->string = newstr;
man->next = ROFF_NEXT_SIBLING;
988}

990void
991roff_elem_alloc(struct roff_man *man, int line, int pos, int tok)
992{
struct roff_node	*n;

n = roff_node_alloc(man, line, pos, ROFFT_ELEM, tok);
roff_node_append(man, n);
man->next = ROFF_NEXT_CHILD;
998}

1000struct roff_node *
1001roff_block_alloc(struct roff_man *man, int line, int pos, int tok)
1002{
struct roff_node	*n;

n = roff_node_alloc(man, line, pos, ROFFT_BLOCK, tok);
roff_node_append(man, n);
man->next = ROFF_NEXT_CHILD;
return n;
1009}

1011struct roff_node *
1012roff_head_alloc(struct roff_man *man, int line, int pos, int tok)
1013{
struct roff_node	*n;

n = roff_node_alloc(man, line, pos, ROFFT_HEAD, tok);
roff_node_append(man, n);
man->next = ROFF_NEXT_CHILD;
return n;
1020}

1022struct roff_node *
1023roff_body_alloc(struct roff_man *man, int line, int pos, int tok)
1024{
struct roff_node	*n;

n = roff_node_alloc(man, line, pos, ROFFT_BODY, tok);
roff_node_append(man, n);
man->next = ROFF_NEXT_CHILD;
return n;
1031}

1033static void
1034roff_addtbl(struct roff_man *man, int line, struct tbl_node *tbl)
1035{
struct roff_node	*n;
struct tbl_span		*span;

if (man->meta.macroset == MACROSET_MAN)
man_breakscope(man, ROFF_TS);
while ((span = tbl_span(tbl)) != NULL((void *)0)) {
n = roff_node_alloc(man, line, 0, ROFFT_TBL, TOKEN_NONE);
n->span = span;
roff_node_append(man, n);
n->flags |= NODE_VALID(1 << 0) | NODE_ENDED(1 << 1);
man->next = ROFF_NEXT_SIBLING;
}
1048}

1050void
1051roff_node_unlink(struct roff_man *man, struct roff_node *n)
1052{

/* Adjust siblings. */

if (n->prev)
11
←
Assuming field 'prev' is null→
12
←
Taking false branch→
n->prev->next = n->next;
if (n->next)
13
←
Assuming field 'next' is null→
14
←
Taking false branch→
n->next->prev = n->prev;

/* Adjust parent. */

if (n->parent != NULL((void *)0)) {
15
←
Assuming field 'parent' is equal to NULL→
16
←
Taking false branch→
if (n->parent->child == n)
	n->parent->child = n->next;
if (n->parent->last == n)
	n->parent->last = n->prev;
}

/* Adjust parse point. */

if (man16.1
'man' is not equal to NULL
 == NULL((void *)0))
17
←
Taking false branch→
return;
if (man->last == n) {
18
←
Assuming 'n' is not equal to field 'last'→
19
←
Taking false branch→
if (n->prev == NULL((void *)0)) {
	man->last = n->parent;
	man->next = ROFF_NEXT_CHILD;
} else {
	man->last = n->prev;
	man->next = ROFF_NEXT_SIBLING;
}
}
if (man->meta.first == n)
20
←
Assuming 'n' is not equal to field 'first'→
21
←
Taking false branch→
man->meta.first = NULL((void *)0);
1085}

1087void
1088roff_node_relink(struct roff_man *man, struct roff_node *n)
1089{
roff_node_unlink(man, n);
n->prev = n->next = NULL((void *)0);
roff_node_append(man, n);
1093}

1095void
1096roff_node_free(struct roff_node *n)
1097{

if (n->args != NULL((void *)0))
24
←
Assuming field 'args' is equal to NULL→
mdoc_argv_free(n->args);
if (n->type == ROFFT_BLOCK || n->type == ROFFT_ELEM)
25
←
Assuming field 'type' is not equal to ROFFT_BLOCK→
26
←
Assuming field 'type' is not equal to ROFFT_ELEM→
27
←
Taking false branch→
free(n->norm);
eqn_box_free(n->eqn);
free(n->string);
free(n->tag);
free(n);
28
←
Memory is released→
1107}

1109void
1110roff_node_delete(struct roff_man *man, struct roff_node *n)
1111{

while (n->child30.1
Field 'child' is not equal to NULL
 != NULL((void *)0))
5
←
Assuming field 'child' is not equal to NULL→
6
←
Loop condition is true.  Entering loop body→
8
←
Assuming field 'child' is equal to NULL→
9
←
Loop condition is false. Execution continues on line 1115→
31
←
Loop condition is true.  Entering loop body→
roff_node_delete(man, n->child);
7
←
Calling 'roff_node_delete'→
30
←
Returning; memory was released via 2nd parameter→
32
←
Use of memory after it is freed
roff_node_unlink(man, n);
10
←
Calling 'roff_node_unlink'→
22
←
Returning from 'roff_node_unlink'→
roff_node_free(n);
23
←
Calling 'roff_node_free'→
29
←
Returning; memory was released via 1st parameter→
1117}

1119int
1120roff_node_transparent(struct roff_node *n)
1121{
if (n == NULL((void *)0))
return 0;
if (n->type == ROFFT_COMMENT || n->flags & NODE_NOPRT(1 << 10))
return 1;
return roff_tok_transparent(n->tok);
1127}

1129int
1130roff_tok_transparent(enum roff_tok tok)
1131{
switch (tok) {
case ROFF_ft:
case ROFF_ll:
case ROFF_mc:
case ROFF_po:
case ROFF_ta:
case MDOC_Db:
case MDOC_Es:
case MDOC_Sm:
case MDOC_Tg:
case MAN_DT:
case MAN_UC:
case MAN_PD:
case MAN_AT:
return 1;
default:
return 0;
}
1150}

1152struct roff_node *
1153roff_node_child(struct roff_node *n)
1154{
for (n = n->child; roff_node_transparent(n); n = n->next)
continue;
return n;
1158}

1160struct roff_node *
1161roff_node_prev(struct roff_node *n)
1162{
do {
n = n->prev;
} while (roff_node_transparent(n));
return n;
1167}

1169struct roff_node *
1170roff_node_next(struct roff_node *n)
1171{
do {
n = n->next;
} while (roff_node_transparent(n));
return n;
1176}

1178void
1179deroff(char **dest, const struct roff_node *n)
1180{
char	*cp;
size_t	 sz;

if (n->string == NULL((void *)0)) {
for (n = n->child; n != NULL((void *)0); n = n->next)
	deroff(dest, n);
return;
}

/* Skip leading whitespace. */

for (cp = n->string; *cp != '\0'; cp++) {
if (cp[0] == '\\' && cp[1] != '\0' &&
    strchr(" %&0^|~", cp[1]) != NULL((void *)0))
	cp++;
else if ( ! isspace((unsigned char)*cp))
	break;
}

/* Skip trailing backslash. */

sz = strlen(cp);
if (sz > 0 && cp[sz - 1] == '\\')
sz--;

/* Skip trailing whitespace. */

for (; sz; sz--)
if ( ! isspace((unsigned char)cp[sz-1]))
	break;

/* Skip empty strings. */

if (sz == 0)
return;

if (*dest == NULL((void *)0)) {
*dest = mandoc_strndup(cp, sz);
return;
}

mandoc_asprintf(&cp, "%s %*s", *dest, (int)sz, cp);
free(*dest);
*dest = cp;
1225}

1227/* --- main functions of the roff parser ---------------------------------- */

1229/*
* Save comments preceding the title macro, for example in order to
* preserve Copyright and license headers in HTML output,
* provide diagnostics about RCS ids and trailing whitespace in comments,
* then discard comments including preceding whitespace.
* This function also handles input line continuation.
*/
1236static int
1237roff_parse_comment(struct roff *r, struct buf *buf, int ln, int pos, char ec)
1238{
struct roff_node *n;	/* used for header comments */
const char	*start;	/* start of the string to process */
const char	*cp;	/* for RCS id parsing */
char		*stesc;	/* start of an escape sequence ('\\') */
char		*ep;	/* end of comment string */
int		 rcsid;	/* kind of RCS id seen */

for (start = stesc = buf->buf + pos;; stesc++) {
/*
 * XXX Ugly hack: Remove the newline character that
 * mparse_buf_r() appended to mark the end of input
 * if it is not preceded by an escape character.
 */
if (stesc[0] == '\n') {
	assert(stesc[1] == '\0')((stesc[1] == '\0') ? (void)0 : __assert2("/usr/src/usr.bin/mandoc/roff.c"
, 1253, __func__, "stesc[1] == '\\0'"));
	stesc[0] = '\0';
}

/* The line ends without continuation or comment. */
if (stesc[0] == '\0')
	return ROFF_CONT0x001;

/* Unescaped byte: skip it. */
if (stesc[0] != ec)
	continue;

/*
 * XXX Ugly hack: Do not attempt to append another line
 * if the function mparse_buf_r() appended a newline
 * character to indicate the end of input.
 */
if (stesc[1] == '\n') {
	assert(stesc[2] == '\0')((stesc[2] == '\0') ? (void)0 : __assert2("/usr/src/usr.bin/mandoc/roff.c"
, 1271, __func__, "stesc[2] == '\\0'"));
	stesc[0] = '\0';
	return ROFF_CONT0x001;
}

/*
 * An escape character at the end of an input line
 * requests line continuation.
 */
if (stesc[1] == '\0') {
	stesc[0] = '\0';
	return ROFF_IGN0x000 | ROFF_APPEND0x010;
}

/* Found a comment: process it. */
if (stesc[1] == '"' || stesc[1] == '#')
	break;

/* Escaped escape character: skip them both. */
if (stesc[1] == ec)
	stesc++;
}

/* Look for an RCS id in the comment. */

rcsid = 0;
if ((cp = strstr(stesc + 2, "$" "OpenBSD")) != NULL((void *)0)) {
rcsid = 1 << MANDOC_OS_OPENBSD;
cp += 8;
} else if ((cp = strstr(stesc + 2, "$" "NetBSD")) != NULL((void *)0)) {
rcsid = 1 << MANDOC_OS_NETBSD;
cp += 7;
}
if (cp != NULL((void *)0) && isalnum((unsigned char)*cp) == 0 &&
   strchr(cp, '$') != NULL((void *)0)) {
if (r->man->meta.rcsids & rcsid)
	mandoc_msg(MANDOCERR_RCS_REP, ln,
	    (int)(stesc - buf->buf) + 2, "%s", stesc + 1);
r->man->meta.rcsids |= rcsid;
}

/* Warn about trailing whitespace at the end of the comment. */

ep = strchr(stesc + 2, '\0') - 1;
if (*ep == '\n')
*ep-- = '\0';
if (*ep == ' ' || *ep == '\t')
mandoc_msg(MANDOCERR_SPACE_EOL,
    ln, (int)(ep - buf->buf), NULL((void *)0));

/* Save comments preceding the title macro in the syntax tree. */

if (r->options & MPARSE_COMMENT(1 << 7)) {
while (*ep == ' ' || *ep == '\t')
	ep--;
ep[1] = '\0';
n = roff_node_alloc(r->man, ln, stesc + 1 - buf->buf,
    ROFFT_COMMENT, TOKEN_NONE);
n->string = mandoc_strdup(stesc + 2);
roff_node_append(r->man, n);
n->flags |= NODE_VALID(1 << 0) | NODE_ENDED(1 << 1);
r->man->next = ROFF_NEXT_SIBLING;
}

/* The comment requests line continuation. */

if (stesc[1] == '#') {
*stesc = '\0';
return ROFF_IGN0x000 | ROFF_APPEND0x010;
}

/* Discard the comment including preceding whitespace. */

while (stesc > start && stesc[-1] == ' ' &&
   (stesc == start + 1 || stesc[-2] != '\\'))
stesc--;
*stesc = '\0';
return ROFF_CONT0x001;
1349}

1351/*
* In the current line, expand escape sequences that produce parsable
* input text.  Also check the syntax of the remaining escape sequences,
* which typically produce output glyphs or change formatter state.
*/
1356static int
1357roff_expand(struct roff *r, struct buf *buf, int ln, int pos, char ec)
1358{
char		 ubuf[24];	/* buffer to print a number */
struct mctx	*ctx;		/* current macro call context */
const char	*res;		/* the string to be pasted */
const char	*src;		/* source for copying */
char		*dst;		/* destination for copying */
enum mandoc_esc	 subtype;	/* return value from roff_escape */
int		 iesc;		/* index of leading escape char */
int		 inam;		/* index of the escape name */
int		 iarg;		/* index beginning the argument */
int		 iendarg;	/* index right after the argument */
int		 iend;		/* index right after the sequence */
int		 isrc, idst;	/* to reduce \\ and \. in names */
int		 deftype;	/* type of definition to paste */
int		 argi;		/* macro argument index */
int		 quote_args;	/* true for \\$@, false for \\$* */
int		 asz;		/* length of the replacement */
int		 rsz;		/* length of the rest of the string */
int		 npos;		/* position in numeric expression */
int		 expand_count;	/* to avoid infinite loops */

expand_count = 0;
while (buf->buf[pos] != '\0') {

/*
 * Skip plain ASCII characters.
 * If we have a non-standard escape character,
 * escape literal backslashes because all processing in
 * subsequent functions uses the standard escaping rules.
 */

if (buf->buf[pos] != ec) {
	if (buf->buf[pos] == '\\') {
		roff_expand_patch(buf, pos, "\\e", pos + 1);
		pos++;
	}
	pos++;
	continue;
}

/*
 * Parse escape sequences,
 * issue diagnostic messages when appropriate,
 * and skip sequences that do not need expansion.
 * If we have a non-standard escape character, translate
 * it to backslashes and translate backslashes to \e.
 */

if (roff_escape(buf->buf, ln, pos, &iesc, &inam,
    &iarg, &iendarg, &iend) != ESCAPE_EXPAND) {
	while (pos < iend) {
		if (buf->buf[pos] == ec) {
			buf->buf[pos] = '\\';
			if (pos + 1 < iend)
				pos++;
		} else if (buf->buf[pos] == '\\') {
			roff_expand_patch(buf,
			    pos, "\\e", pos + 1);
			pos++;
			iend++;
		}
		pos++;
	}
	continue;
}

/* Reduce \\ and \. in names. */

if (buf->buf[inam] == '*' || buf->buf[inam] == 'n') {
	isrc = idst = iarg;
	while (isrc < iendarg) {
		if (isrc + 1 < iendarg &&
		    buf->buf[isrc] == '\\' &&
		    (buf->buf[isrc + 1] == '\\' ||
		     buf->buf[isrc + 1] == '.'))
			isrc++;
		buf->buf[idst++] = buf->buf[isrc++];
	}
	iendarg -= isrc - idst;
}

/* Handle expansion. */

res = NULL((void *)0);
switch (buf->buf[inam]) {
case '*':
	if (iendarg == iarg)
		break;
	deftype = ROFFDEF_USER(1 << 1) | ROFFDEF_PRE(1 << 2);
	if ((res = roff_getstrn(r, buf->buf + iarg,
	    iendarg - iarg, &deftype)) != NULL((void *)0))
		break;

	/*
	 * If not overridden,
	 * let \*(.T through to the formatters.
	 */

	if (iendarg - iarg == 2 &&
	    buf->buf[iarg] == '.' &&
	    buf->buf[iarg + 1] == 'T') {
		roff_setstrn(&r->strtab, ".T", 2, NULL((void *)0), 0, 0);
		pos = iend;
		continue;
	}

	mandoc_msg(MANDOCERR_STR_UNDEF, ln, iesc,
	    "%.*s", iendarg - iarg, buf->buf + iarg);
	break;

case '$':
	if (r->mstackpos < 0) {
		mandoc_msg(MANDOCERR_ARG_UNDEF, ln, iesc,
		    "%.*s", iend - iesc, buf->buf + iesc);
		break;
	}
	ctx = r->mstack + r->mstackpos;
	argi = buf->buf[iarg] - '1';
	if (argi >= 0 && argi <= 8) {
		if (argi < ctx->argc)
			res = ctx->argv[argi];
		break;
	}
	if (buf->buf[iarg] == '*')
		quote_args = 0;
	else if (buf->buf[iarg] == '@')
		quote_args = 1;
	else {
		mandoc_msg(MANDOCERR_ARG_NONUM, ln, iesc,
		    "%.*s", iend - iesc, buf->buf + iesc);
		break;
	}
	asz = 0;
	for (argi = 0; argi < ctx->argc; argi++) {
		if (argi)
			asz++;  /* blank */
		if (quote_args)
			asz += 2;  /* quotes */
		asz += strlen(ctx->argv[argi]);
	}
	if (asz != iend - iesc) {
		rsz = buf->sz - iend;
		if (asz < iend - iesc)
			memmove(buf->buf + iesc + asz,
			    buf->buf + iend, rsz);
		buf->sz = iesc + asz + rsz;
		buf->buf = mandoc_realloc(buf->buf, buf->sz);
		if (asz > iend - iesc)
			memmove(buf->buf + iesc + asz,
			    buf->buf + iend, rsz);
	}
	dst = buf->buf + iesc;
	for (argi = 0; argi < ctx->argc; argi++) {
		if (argi)
			*dst++ = ' ';
		if (quote_args)
			*dst++ = '"';
		src = ctx->argv[argi];
		while (*src != '\0')
			*dst++ = *src++;
		if (quote_args)
			*dst++ = '"';
	}
	continue;
case 'A':
	ubuf[0] = iendarg > iarg ? '1' : '0';
	ubuf[1] = '\0';
	res = ubuf;
	break;
case 'B':
	npos = 0;
	ubuf[0] = iendarg > iarg && iend > iendarg &&
	    roff_evalnum(r, ln, buf->buf + iarg, &npos,
			 NULL((void *)0), ROFFNUM_SCALE(1 << 0)) &&
	    npos == iendarg - iarg ? '1' : '0';
	ubuf[1] = '\0';
	res = ubuf;
	break;
case 'V':
	mandoc_msg(MANDOCERR_UNSUPP, ln, iesc,
	    "%.*s", iend - iesc, buf->buf + iesc);
	roff_expand_patch(buf, iendarg, "}", iend);
	roff_expand_patch(buf, iesc, "${", iarg);
	continue;
case 'g':
	break;
case 'n':
	if (iendarg > iarg)
		(void)snprintf(ubuf, sizeof(ubuf), "%d",
		    roff_getregn(r, buf->buf + iarg,
		    iendarg - iarg, buf->buf[inam + 1]));
	else
		ubuf[0] = '\0';
	res = ubuf;
	break;
case 'w':
	rsz = 0;
	subtype = ESCAPE_UNDEF;
	while (iarg < iendarg) {
		asz = subtype == ESCAPE_SKIPCHAR ? 0 : 1;
		if (buf->buf[iarg] != '\\') {
			rsz += asz;
			iarg++;
			continue;
		}
		switch ((subtype = roff_escape(buf->buf, 0,
		    iarg, NULL((void *)0), NULL((void *)0), NULL((void *)0), NULL((void *)0), &iarg))) {
		case ESCAPE_SPECIAL:
		case ESCAPE_NUMBERED:
		case ESCAPE_UNICODE:
		case ESCAPE_OVERSTRIKE:
		case ESCAPE_UNDEF:
			break;
		case ESCAPE_DEVICE:
			asz *= 8;
			break;
		case ESCAPE_EXPAND:
			abort();
		default:
			continue;
		}
		rsz += asz;
	}
	(void)snprintf(ubuf, sizeof(ubuf), "%d", rsz * 24);
	res = ubuf;
	break;
default:
	break;
}
if (res == NULL((void *)0))
	res = "";
if (++expand_count > EXPAND_LIMIT1000 ||
    buf->sz + strlen(res) > SHRT_MAX0x7fff) {
	mandoc_msg(MANDOCERR_ROFFLOOP, ln, iesc, NULL((void *)0));
	return ROFF_IGN0x000;
}
roff_expand_patch(buf, iesc, res, iend);
}
return ROFF_CONT0x001;
1597}

1599/*
* Replace the substring from the start position (inclusive)
* to end position (exclusive) with the repl(acement) string.
*/
1603static void
1604roff_expand_patch(struct buf *buf, int start, const char *repl, int end)
1605{
char	*nbuf;

buf->sz = mandoc_asprintf(&nbuf, "%.*s%s%s", start, buf->buf,
   repl, buf->buf + end) + 1;
free(buf->buf);
buf->buf = nbuf;
1612}

1614/*
* Parse a quoted or unquoted roff-style request or macro argument.
* Return a pointer to the parsed argument, which is either the original
* pointer or advanced by one byte in case the argument is quoted.
* NUL-terminate the argument in place.
* Collapse pairs of quotes inside quoted arguments.
* Advance the argument pointer to the next argument,
* or to the NUL byte terminating the argument line.
*/
1623char *
1624roff_getarg(struct roff *r, char **cpp, int ln, int *pos)
1625{
struct buf	 buf;
char		*cp, *start;
int		 newesc, pairs, quoted, white;

/* Quoting can only start with a new word. */
start = *cpp;
quoted = 0;
if ('"' == *start) {
quoted = 1;
start++;
}

newesc = pairs = white = 0;
for (cp = start; '\0' != *cp; cp++) {

/*
 * Move the following text left
 * after quoted quotes and after "\\" and "\t".
 */
if (pairs)
	cp[-pairs] = cp[0];

if ('\\' == cp[0]) {
	/*
	 * In copy mode, translate double to single
	 * backslashes and backslash-t to literal tabs.
	 */
	switch (cp[1]) {
	case 'a':
	case 't':
		cp[-pairs] = '\t';
		pairs++;
		cp++;
		break;
	case '\\':
		cp[-pairs] = '\\';
		newesc = 1;
		pairs++;
		cp++;
		break;
	case ' ':
		/* Skip escaped blanks. */
		if (0 == quoted)
			cp++;
		break;
	default:
		break;
	}
} else if (0 == quoted) {
	if (' ' == cp[0]) {
		/* Unescaped blanks end unquoted args. */
		white = 1;
		break;
	}
} else if ('"' == cp[0]) {
	if ('"' == cp[1]) {
		/* Quoted quotes collapse. */
		pairs++;
		cp++;
	} else {
		/* Unquoted quotes end quoted args. */
		quoted = 2;
		break;
	}
}
}

/* Quoted argument without a closing quote. */
if (1 == quoted)
mandoc_msg(MANDOCERR_ARG_QUOTE, ln, *pos, NULL((void *)0));

/* NUL-terminate this argument and move to the next one. */
if (pairs)
cp[-pairs] = '\0';
if ('\0' != *cp) {
*cp++ = '\0';
while (' ' == *cp)
	cp++;
}
*pos += (int)(cp - start) + (quoted ? 1 : 0);
*cpp = cp;

if ('\0' == *cp && (white || ' ' == cp[-1]))
mandoc_msg(MANDOCERR_SPACE_EOL, ln, *pos, NULL((void *)0));

start = mandoc_strdup(start);
if (newesc == 0)
return start;

buf.buf = start;
buf.sz = strlen(start) + 1;
buf.next = NULL((void *)0);
if (roff_expand(r, &buf, ln, 0, '\\') == ROFF_IGN0x000) {
free(buf.buf);
buf.buf = mandoc_strdup("");
}
return buf.buf;
1723}


1726/*
* Process text streams.
*/
1729static int
1730roff_parsetext(struct roff *r, struct buf *buf, int pos, int *offs)
1731{
size_t		 sz;
const char	*start;
char		*p;
int		 isz;
enum mandoc_esc	 esc;

/* Spring the input line trap. */

if (roffit_lines == 1) {
isz = mandoc_asprintf(&p, "%s\n.%s", buf->buf, roffit_macro);
free(buf->buf);
buf->buf = p;
buf->sz = isz + 1;
*offs = 0;
free(roffit_macro);
roffit_lines = 0;
return ROFF_REPARSE0x004;
} else if (roffit_lines > 1)
--roffit_lines;

if (roffce_node != NULL((void *)0) && buf->buf[pos] != '\0') {
if (roffce_lines < 1) {
	r->man->last = roffce_node;
	r->man->next = ROFF_NEXT_SIBLING;
	roffce_lines = 0;
	roffce_node = NULL((void *)0);
} else
	roffce_lines--;
}

/* Convert all breakable hyphens into ASCII_HYPH. */

start = p = buf->buf + pos;

while (*p != '\0') {
sz = strcspn(p, "-\\");
p += sz;

if (*p == '\0')
	break;

if (*p == '\\') {
	/* Skip over escapes. */
	p++;
	esc = mandoc_escape((const char **)&p, NULL((void *)0), NULL((void *)0));
	if (esc == ESCAPE_ERROR)
		break;
	while (*p == '-')
		p++;
	continue;
} else if (p == start) {
	p++;
	continue;
}

if (isalpha((unsigned char)p[-1]) &&
    isalpha((unsigned char)p[1]))
	*p = ASCII_HYPH28;
p++;
}
return ROFF_CONT0x001;
1793}

1795int
1796roff_parseln(struct roff *r, int ln, struct buf *buf, int *offs, size_t len)
1797{
enum roff_tok	 t;
int		 e;
int		 pos;	/* parse point */
int		 spos;	/* saved parse point for messages */
int		 ppos;	/* original offset in buf->buf */
int		 ctl;	/* macro line (boolean) */

ppos = pos = *offs;

if (len > 80 && r->tbl == NULL((void *)0) && r->eqn == NULL((void *)0) &&
   (r->man->flags & ROFF_NOFILL(1 << 1)) == 0 &&
   strchr(" .\\", buf->buf[pos]) == NULL((void *)0) &&
   buf->buf[pos] != r->control &&
   strcspn(buf->buf, " ") < 80)
mandoc_msg(MANDOCERR_TEXT_LONG, ln, (int)len - 1,
    "%.20s...", buf->buf + pos);

/* Handle in-line equation delimiters. */

if (r->tbl == NULL((void *)0) &&
   r->last_eqn != NULL((void *)0) && r->last_eqn->delim &&
   (r->eqn == NULL((void *)0) || r->eqn_inline)) {
e = roff_eqndelim(r, buf, pos);
if (e == ROFF_REPARSE0x004)
	return e;
assert(e == ROFF_CONT)((e == 0x001) ? (void)0 : __assert2("/usr/src/usr.bin/mandoc/roff.c"
, 1823, __func__, "e == ROFF_CONT"));
}

/* Handle comments and escape sequences. */

e = roff_parse_comment(r, buf, ln, pos, r->escape);
if ((e & ROFF_MASK0x00f) == ROFF_IGN0x000)
return e;
assert(e == ROFF_CONT)((e == 0x001) ? (void)0 : __assert2("/usr/src/usr.bin/mandoc/roff.c"
, 1831, __func__, "e == ROFF_CONT"));

e = roff_expand(r, buf, ln, pos, r->escape);
if ((e & ROFF_MASK0x00f) == ROFF_IGN0x000)
return e;
assert(e == ROFF_CONT)((e == 0x001) ? (void)0 : __assert2("/usr/src/usr.bin/mandoc/roff.c"
, 1836, __func__, "e == ROFF_CONT"));

ctl = roff_getcontrol(r, buf->buf, &pos);

/*
* First, if a scope is open and we're not a macro, pass the
* text through the macro's filter.
* Equations process all content themselves.
* Tables process almost all content themselves, but we want
* to warn about macros before passing it there.
*/

if (r->last != NULL((void *)0) && ! ctl) {
t = r->last->tok;
e = (*roffs[t].text)(r, t, buf, ln, pos, pos, offs);
if ((e & ROFF_MASK0x00f) == ROFF_IGN0x000)
	return e;
e &= ~ROFF_MASK0x00f;
} else
e = ROFF_IGN0x000;
if (r->eqn != NULL((void *)0) && strncmp(buf->buf + ppos, ".EN", 3)) {
eqn_read(r->eqn, buf->buf + ppos);
return e;
}
if (r->tbl != NULL((void *)0) && (ctl == 0 || buf->buf[pos] == '\0')) {
tbl_read(r->tbl, ln, buf->buf, ppos);
roff_addtbl(r->man, ln, r->tbl);
return e;
}
if ( ! ctl) {
r->options &= ~MPARSE_COMMENT(1 << 7);
return roff_parsetext(r, buf, pos, offs) | e;
}

/* Skip empty request lines. */

if (buf->buf[pos] == '"') {
mandoc_msg(MANDOCERR_COMMENT_BAD, ln, pos, NULL((void *)0));
return ROFF_IGN0x000;
} else if (buf->buf[pos] == '\0')
return ROFF_IGN0x000;

/*
* If a scope is open, go to the child handler for that macro,
* as it may want to preprocess before doing anything with it.
*/

if (r->last) {
t = r->last->tok;
return (*roffs[t].sub)(r, t, buf, ln, ppos, pos, offs);
}

r->options &= ~MPARSE_COMMENT(1 << 7);
spos = pos;
t = roff_parse(r, buf->buf, &pos, ln, ppos);
return roff_req_or_macro(r, t, buf, ln, spos, pos, offs);
1892}

1894/*
* Handle a new request or macro.
* May be called outside any scope or from inside a conditional scope.
*/
1898static int
1899roff_req_or_macro(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs) {

/* For now, tables ignore most macros and some request. */

if (r->tbl != NULL((void *)0) && (tok == TOKEN_NONE || tok == ROFF_TS ||
   tok == ROFF_br || tok == ROFF_ce || tok == ROFF_rj ||
   tok == ROFF_sp)) {
mandoc_msg(MANDOCERR_TBLMACRO,
    ln, ppos, "%s", buf->buf + ppos);
if (tok != TOKEN_NONE)
	return ROFF_IGN0x000;
while (buf->buf[pos] != '\0' && buf->buf[pos] != ' ')
	pos++;
while (buf->buf[pos] == ' ')
	pos++;
tbl_read(r->tbl, ln, buf->buf, pos);
roff_addtbl(r->man, ln, r->tbl);
return ROFF_IGN0x000;
}

/* For now, let high level macros abort .ce mode. */

if (roffce_node != NULL((void *)0) &&
   (tok == TOKEN_NONE || tok == ROFF_Dd || tok == ROFF_EQ ||
    tok == ROFF_TH || tok == ROFF_TS)) {
r->man->last = roffce_node;
r->man->next = ROFF_NEXT_SIBLING;
roffce_lines = 0;
roffce_node = NULL((void *)0);
}

/*
* This is neither a roff request nor a user-defined macro.
* Let the standard macro set parsers handle it.
*/

if (tok == TOKEN_NONE)
return ROFF_CONT0x001;

/* Execute a roff request or a user-defined macro. */

return (*roffs[tok].proc)(r, tok, buf, ln, ppos, pos, offs);
1941}

1943/*
* Internal interface function to tell the roff parser that execution
* of the current macro ended.  This is required because macro
* definitions usually do not end with a .return request.
*/
1948void
1949roff_userret(struct roff *r)
1950{
struct mctx	*ctx;
int		 i;

assert(r->mstackpos >= 0)((r->mstackpos >= 0) ? (void)0 : __assert2("/usr/src/usr.bin/mandoc/roff.c"
, 1954, __func__, "r->mstackpos >= 0"));
ctx = r->mstack + r->mstackpos;
for (i = 0; i < ctx->argc; i++)
free(ctx->argv[i]);
ctx->argc = 0;
r->mstackpos--;
1960}

1962void
1963roff_endparse(struct roff *r)
1964{
if (r->last != NULL((void *)0))
mandoc_msg(MANDOCERR_BLK_NOEND, r->last->line,
    r->last->col, "%s", roff_name[r->last->tok]);

if (r->eqn != NULL((void *)0)) {
mandoc_msg(MANDOCERR_BLK_NOEND,
    r->eqn->node->line, r->eqn->node->pos, "EQ");
eqn_parse(r->eqn);
r->eqn = NULL((void *)0);
}

if (r->tbl != NULL((void *)0)) {
tbl_end(r->tbl, 1);
r->tbl = NULL((void *)0);
}
1980}

1982/*
* Parse the request or macro name at buf[*pos].
* Return ROFF_RENAMED, ROFF_USERDEF, or a ROFF_* token value.
* For empty, undefined, mdoc(7), and man(7) macros, return TOKEN_NONE.
* As a side effect, set r->current_string to the definition or to NULL.
*/
1988static enum roff_tok
1989roff_parse(struct roff *r, char *buf, int *pos, int ln, int ppos)
1990{
char		*cp;
const char	*mac;
size_t		 maclen;
int		 deftype;
enum roff_tok	 t;

cp = buf + *pos;

if ('\0' == *cp || '"' == *cp || '\t' == *cp || ' ' == *cp)
return TOKEN_NONE;

mac = cp;
maclen = roff_getname(r, &cp, ln, ppos);

deftype = ROFFDEF_USER(1 << 1) | ROFFDEF_REN(1 << 3);
r->current_string = roff_getstrn(r, mac, maclen, &deftype);
switch (deftype) {
case ROFFDEF_USER(1 << 1):
t = ROFF_USERDEF;
break;
case ROFFDEF_REN(1 << 3):
t = ROFF_RENAMED;
break;
default:
t = roffhash_find(r->reqtab, mac, maclen);
break;
}
if (t != TOKEN_NONE)
*pos = cp - buf;
else if (deftype == ROFFDEF_UNDEF(1 << 5)) {
/* Using an undefined macro defines it to be empty. */
roff_setstrn(&r->strtab, mac, maclen, "", 0, 0);
roff_setstrn(&r->rentab, mac, maclen, NULL((void *)0), 0, 0);
}
return t;
2026}

2028/* --- handling of request blocks ----------------------------------------- */

2030/*
* Close a macro definition block or an "ignore" block.
*/
2033static int
2034roff_cblock(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
2035{
int	 rr;

if (r->last == NULL((void *)0)) {
mandoc_msg(MANDOCERR_BLK_NOTOPEN, ln, ppos, "..");
return ROFF_IGN0x000;
}

switch (r->last->tok) {
case ROFF_am:
case ROFF_ami:
case ROFF_de:
case ROFF_dei:
case ROFF_ig:
break;
case ROFF_am1:
case ROFF_de1:
/* Remapped in roff_block(). */
abort();
default:
mandoc_msg(MANDOCERR_BLK_NOTOPEN, ln, ppos, "..");
return ROFF_IGN0x000;
}

roffnode_pop(r);
roffnode_cleanscope(r);

/*
* If a conditional block with braces is still open,
* check for "\}" block end markers.
*/

if (r->last != NULL((void *)0) && r->last->endspan < 0) {
rr = 1;  /* If arguments follow "\}", warn about them. */
roff_cond_checkend(r, tok, buf, ln, ppos, pos, &rr);
}

if (buf->buf[pos] != '\0')
mandoc_msg(MANDOCERR_ARG_SKIP, ln, pos,
    ".. %s", buf->buf + pos);

return ROFF_IGN0x000;
2077}

2079/*
* Pop all nodes ending at the end of the current input line.
* Return the number of loops ended.
*/
2083static int
2084roffnode_cleanscope(struct roff *r)
2085{
int inloop;

inloop = 0;
while (r->last != NULL((void *)0) && r->last->endspan > 0) {
if (--r->last->endspan != 0)
	break;
inloop += roffnode_pop(r);
}
return inloop;
2095}

2097/*
* Handle the closing "\}" of a conditional block.
* Apart from generating warnings, this only pops nodes.
* Return the number of loops ended.
*/
2102static int
2103roff_ccond(struct roff *r, int ln, int ppos)
2104{
if (NULL((void *)0) == r->last) {
mandoc_msg(MANDOCERR_BLK_NOTOPEN, ln, ppos, "\\}");
return 0;
}

switch (r->last->tok) {
case ROFF_el:
case ROFF_ie:
case ROFF_if:
case ROFF_while:
break;
default:
mandoc_msg(MANDOCERR_BLK_NOTOPEN, ln, ppos, "\\}");
return 0;
}

if (r->last->endspan > -1) {
mandoc_msg(MANDOCERR_BLK_NOTOPEN, ln, ppos, "\\}");
return 0;
}

return roffnode_pop(r) + roffnode_cleanscope(r);
2127}

2129static int
2130roff_block(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
2131{
const char	*name, *value;
char		*call, *cp, *iname, *rname;
size_t		 csz, namesz, rsz;
int		 deftype;

/* Ignore groff compatibility mode for now. */

if (tok == ROFF_de1)
tok = ROFF_de;
else if (tok == ROFF_dei1)
tok = ROFF_dei;
else if (tok == ROFF_am1)
tok = ROFF_am;
else if (tok == ROFF_ami1)
tok = ROFF_ami;

/* Parse the macro name argument. */

cp = buf->buf + pos;
if (tok == ROFF_ig) {
iname = NULL((void *)0);
namesz = 0;
} else {
iname = cp;
namesz = roff_getname(r, &cp, ln, ppos);
iname[namesz] = '\0';
}

/* Resolve the macro name argument if it is indirect. */

if (namesz && (tok == ROFF_dei || tok == ROFF_ami)) {
deftype = ROFFDEF_USER(1 << 1);
name = roff_getstrn(r, iname, namesz, &deftype);
if (name == NULL((void *)0)) {
	mandoc_msg(MANDOCERR_STR_UNDEF,
	    ln, (int)(iname - buf->buf),
	    "%.*s", (int)namesz, iname);
	namesz = 0;
} else
	namesz = strlen(name);
} else
name = iname;

if (namesz == 0 && tok != ROFF_ig) {
mandoc_msg(MANDOCERR_REQ_EMPTY,
    ln, ppos, "%s", roff_name[tok]);
return ROFF_IGN0x000;
}

roffnode_push(r, tok, name, ln, ppos);

/*
* At the beginning of a `de' macro, clear the existing string
* with the same name, if there is one.  New content will be
* appended from roff_block_text() in multiline mode.
*/

if (tok == ROFF_de || tok == ROFF_dei) {
roff_setstrn(&r->strtab, name, namesz, "", 0, 0);
roff_setstrn(&r->rentab, name, namesz, NULL((void *)0), 0, 0);
} else if (tok == ROFF_am || tok == ROFF_ami) {
deftype = ROFFDEF_ANY((1 << 1) | (1 << 2) | (1 << 3) | (1 <<
 4));
value = roff_getstrn(r, iname, namesz, &deftype);
switch (deftype) {  /* Before appending, ... */
case ROFFDEF_PRE(1 << 2): /* copy predefined to user-defined. */
	roff_setstrn(&r->strtab, name, namesz,
	    value, strlen(value), 0);
	break;
case ROFFDEF_REN(1 << 3): /* call original standard macro. */
	csz = mandoc_asprintf(&call, ".%.*s \\$* \\\"\n",
	    (int)strlen(value), value);
	roff_setstrn(&r->strtab, name, namesz, call, csz, 0);
	roff_setstrn(&r->rentab, name, namesz, NULL((void *)0), 0, 0);
	free(call);
	break;
case ROFFDEF_STD(1 << 4):  /* rename and call standard macro. */
	rsz = mandoc_asprintf(&rname, "__%s_renamed", name);
	roff_setstrn(&r->rentab, rname, rsz, name, namesz, 0);
	csz = mandoc_asprintf(&call, ".%.*s \\$* \\\"\n",
	    (int)rsz, rname);
	roff_setstrn(&r->strtab, name, namesz, call, csz, 0);
	free(call);
	free(rname);
	break;
default:
	break;
}
}

if (*cp == '\0')
return ROFF_IGN0x000;

/* Get the custom end marker. */

iname = cp;
namesz = roff_getname(r, &cp, ln, ppos);

/* Resolve the end marker if it is indirect. */

if (namesz && (tok == ROFF_dei || tok == ROFF_ami)) {
deftype = ROFFDEF_USER(1 << 1);
name = roff_getstrn(r, iname, namesz, &deftype);
if (name == NULL((void *)0)) {
	mandoc_msg(MANDOCERR_STR_UNDEF,
	    ln, (int)(iname - buf->buf),
	    "%.*s", (int)namesz, iname);
	namesz = 0;
} else
	namesz = strlen(name);
} else
name = iname;

if (namesz)
r->last->end = mandoc_strndup(name, namesz);

if (*cp != '\0')
mandoc_msg(MANDOCERR_ARG_EXCESS,
    ln, pos, ".%s ... %s", roff_name[tok], cp);

return ROFF_IGN0x000;
2252}

2254static int
2255roff_block_sub(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
2256{
enum roff_tok	t;
int		i, j;

/*
* If a custom end marker is a user-defined or predefined macro
* or a request, interpret it.
*/

if (r->last->end) {
for (i = pos, j = 0; r->last->end[j]; j++, i++)
	if (buf->buf[i] != r->last->end[j])
		break;

if (r->last->end[j] == '\0' &&
    (buf->buf[i] == '\0' ||
     buf->buf[i] == ' ' ||
     buf->buf[i] == '\t')) {
	roffnode_pop(r);
	roffnode_cleanscope(r);

	while (buf->buf[i] == ' ' || buf->buf[i] == '\t')
		i++;

	pos = i;
	if (roff_parse(r, buf->buf, &pos, ln, ppos) !=
	    TOKEN_NONE)
		return ROFF_RERUN0x002;
	return ROFF_IGN0x000;
}
}

/* Handle the standard end marker. */

t = roff_parse(r, buf->buf, &pos, ln, ppos);
if (t == ROFF_cblock)
return roff_cblock(r, t, buf, ln, ppos, pos, offs);

/* Not an end marker, so append the line to the block. */

if (tok != ROFF_ig)
roff_setstr(r, r->last->name, buf->buf + ppos, 2);
return ROFF_IGN0x000;
2299}

2301static int
2302roff_block_text(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
2303{

if (tok != ROFF_ig)
roff_setstr(r, r->last->name, buf->buf + pos, 2);

return ROFF_IGN0x000;
2309}

2311/*
* Check for a closing "\}" and handle it.
* In this function, the final "int *offs" argument is used for
* different purposes than elsewhere:
* Input: *offs == 0: caller wants to discard arguments following \}
*        *offs == 1: caller wants to preserve text following \}
* Output: *offs = 0: tell caller to discard input line
*         *offs = 1: tell caller to use input line
*/
2320static int
2321roff_cond_checkend(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
2322{
char		*ep;
int		 endloop, irc, rr;

irc = ROFF_IGN0x000;
rr = r->last->rule;
endloop = tok != ROFF_while ? ROFF_IGN0x000 :
   rr ? ROFF_LOOPCONT0x200 : ROFF_LOOPEXIT0x400;
if (roffnode_cleanscope(r))
irc |= endloop;

/*
* If "\}" occurs on a macro line without a preceding macro or
* a text line contains nothing else, drop the line completely.
*/

ep = buf->buf + pos;
if (ep[0] == '\\' && ep[1] == '}' && (ep[2] == '\0' || *offs == 0))
rr = 0;

/*
* The closing delimiter "\}" rewinds the conditional scope
* but is otherwise ignored when interpreting the line.
*/

while ((ep = strchr(ep, '\\')) != NULL((void *)0)) {
switch (ep[1]) {
case '}':
	if (ep[2] == '\0')
		ep[0] = '\0';
	else if (rr)
		ep[1] = '&';
	else
		memmove(ep, ep + 2, strlen(ep + 2) + 1);
	if (roff_ccond(r, ln, ep - buf->buf))
		irc |= endloop;
	break;
case '\0':
	++ep;
	break;
default:
	ep += 2;
	break;
}
}
*offs = rr;
return irc;
2369}

2371/*
* Parse and process a request or macro line in conditional scope.
*/
2374static int
2375roff_cond_sub(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
2376{
struct roffnode	*bl;
int		 irc, rr, spos;
enum roff_tok	 t;

rr = 0;  /* If arguments follow "\}", skip them. */
irc = roff_cond_checkend(r, tok, buf, ln, ppos, pos, &rr);
spos = pos;
t = roff_parse(r, buf->buf, &pos, ln, ppos);

/*
* Handle requests and macros if the conditional evaluated
* to true or if they are structurally required.
* The .break request is always handled specially.
*/

if (t == ROFF_break) {
if (irc & ROFF_LOOPMASK0xf00)
	irc = ROFF_IGN0x000 | ROFF_LOOPEXIT0x400;
else if (rr) {
	for (bl = r->last; bl != NULL((void *)0); bl = bl->parent) {
		bl->rule = 0;
		if (bl->tok == ROFF_while)
			break;
	}
}
} else if (rr || (t < TOKEN_NONE && roffs[t].flags & ROFFMAC_STRUCT(1 << 0))) {
irc |= roff_req_or_macro(r, t, buf, ln, spos, pos, offs);
if (irc & ROFF_WHILE0x100)
	irc &= ~(ROFF_LOOPCONT0x200 | ROFF_LOOPEXIT0x400);
}
return irc;
2408}

2410/*
* Parse and process a text line in conditional scope.
*/
2413static int
2414roff_cond_text(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
2415{
int	 irc, rr;

rr = 1;  /* If arguments follow "\}", preserve them. */
irc = roff_cond_checkend(r, tok, buf, ln, ppos, pos, &rr);
if (rr)
irc |= ROFF_CONT0x001;
return irc;
2423}

2425/* --- handling of numeric and conditional expressions -------------------- */

2427/*
* Parse a single signed integer number.  Stop at the first non-digit.
* If there is at least one digit, return success and advance the
* parse point, else return failure and let the parse point unchanged.
* Ignore overflows, treat them just like the C language.
*/
2433static int
2434roff_getnum(const char *v, int *pos, int *res, int flags)
2435{
int	 myres, scaled, n, p;

if (NULL((void *)0) == res)
res = &myres;

p = *pos;
n = v[p] == '-';
if (n || v[p] == '+')
p++;

if (flags & ROFFNUM_WHITE(1 << 1))
while (isspace((unsigned char)v[p]))
	p++;

for (*res = 0; isdigit((unsigned char)v[p]); p++)
*res = 10 * *res + v[p] - '0';
if (p == *pos + n)
return 0;

if (n)
*res = -*res;

/* Each number may be followed by one optional scaling unit. */

switch (v[p]) {
case 'f':
scaled = *res * 65536;
break;
case 'i':
scaled = *res * 240;
break;
case 'c':
scaled = *res * 240 / 2.54;
break;
case 'v':
case 'P':
scaled = *res * 40;
break;
case 'm':
case 'n':
scaled = *res * 24;
break;
case 'p':
scaled = *res * 10 / 3;
break;
case 'u':
scaled = *res;
break;
case 'M':
scaled = *res * 6 / 25;
break;
default:
scaled = *res;
p--;
break;
}
if (flags & ROFFNUM_SCALE(1 << 0))
*res = scaled;

*pos = p + 1;
return 1;
2497}

2499/*
* Evaluate a string comparison condition.
* The first character is the delimiter.
* Succeed if the string up to its second occurrence
* matches the string up to its third occurrence.
* Advance the cursor after the third occurrence
* or lacking that, to the end of the line.
*/
2507static int
2508roff_evalstrcond(const char *v, int *pos)
2509{
const char	*s1, *s2, *s3;
int		 match;

match = 0;
s1 = v + *pos;		/* initial delimiter */
s2 = s1 + 1;		/* for scanning the first string */
s3 = strchr(s2, *s1);	/* for scanning the second string */

if (NULL((void *)0) == s3)		/* found no middle delimiter */
goto out;

while ('\0' != *++s3) {
if (*s2 != *s3) {  /* mismatch */
	s3 = strchr(s3, *s1);
	break;
}
if (*s3 == *s1) {  /* found the final delimiter */
	match = 1;
	break;
}
s2++;
}

2533out:
if (NULL((void *)0) == s3)
s3 = strchr(s2, '\0');
else if (*s3 != '\0')
s3++;
*pos = s3 - v;
return match;
2540}

2542/*
* Evaluate an optionally negated single character, numerical,
* or string condition.
*/
2546static int
2547roff_evalcond(struct roff *r, int ln, char *v, int *pos)
2548{
const char	*start, *end;
char		*cp, *name;
size_t		 sz;
int		 deftype, len, number, savepos, istrue, wanttrue;

if ('!' == v[*pos]) {
wanttrue = 0;
(*pos)++;
} else
wanttrue = 1;

switch (v[*pos]) {
case '\0':
return 0;
case 'n':
case 'o':
(*pos)++;
return wanttrue;
case 'e':
case 't':
case 'v':
(*pos)++;
return !wanttrue;
case 'c':
do {
	(*pos)++;
} while (v[*pos] == ' ');

/*
 * Quirk for groff compatibility:
 * The horizontal tab is neither available nor unavailable.
 */

if (v[*pos] == '\t') {
	(*pos)++;
	return 0;
}

/* Printable ASCII characters are available. */

if (v[*pos] != '\\') {
	(*pos)++;
	return wanttrue;
}

end = v + ++*pos;
switch (mandoc_escape(&end, &start, &len)) {
case ESCAPE_SPECIAL:
	istrue = mchars_spec2cp(start, len) != -1;
	break;
case ESCAPE_UNICODE:
	istrue = 1;
	break;
case ESCAPE_NUMBERED:
	istrue = mchars_num2char(start, len) != -1;
	break;
default:
	istrue = !wanttrue;
	break;
}
*pos = end - v;
return istrue == wanttrue;
case 'd':
case 'r':
cp = v + *pos + 1;
while (*cp == ' ')
	cp++;
name = cp;
sz = roff_getname(r, &cp, ln, cp - v);
if (sz == 0)
	istrue = 0;
else if (v[*pos] == 'r')
	istrue = roff_hasregn(r, name, sz);
else {
	deftype = ROFFDEF_ANY((1 << 1) | (1 << 2) | (1 << 3) | (1 <<
 4));
        roff_getstrn(r, name, sz, &deftype);
	istrue = !!deftype;
}
*pos = (name + sz) - v;
return istrue == wanttrue;
default:
break;
}

savepos = *pos;
if (roff_evalnum(r, ln, v, pos, &number, ROFFNUM_SCALE(1 << 0)))
return (number > 0) == wanttrue;
else if (*pos == savepos)
return roff_evalstrcond(v, pos) == wanttrue;
else
return 0;
2640}

2642static int
2643roff_line_ignore(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
2644{

return ROFF_IGN0x000;
2647}

2649static int
2650roff_insec(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
2651{

mandoc_msg(MANDOCERR_REQ_INSEC, ln, ppos, "%s", roff_name[tok]);
return ROFF_IGN0x000;
2655}

2657static int
2658roff_unsupp(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
2659{

mandoc_msg(MANDOCERR_REQ_UNSUPP, ln, ppos, "%s", roff_name[tok]);
return ROFF_IGN0x000;
2663}

2665static int
2666roff_cond(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
2667{
int	 irc;

roffnode_push(r, tok, NULL((void *)0), ln, ppos);

/*
* An `.el' has no conditional body: it will consume the value
* of the current rstack entry set in prior `ie' calls or
* defaults to DENY.
*
* If we're not an `el', however, then evaluate the conditional.
*/

r->last->rule = tok == ROFF_el ?
   (r->rstackpos < 0 ? 0 : r->rstack[r->rstackpos--]) :
   roff_evalcond(r, ln, buf->buf, &pos);

/*
* An if-else will put the NEGATION of the current evaluated
* conditional into the stack of rules.
*/

if (tok == ROFF_ie) {
if (r->rstackpos + 1 == r->rstacksz) {
	r->rstacksz += 16;
	r->rstack = mandoc_reallocarray(r->rstack,
	    r->rstacksz, sizeof(int));
}
r->rstack[++r->rstackpos] = !r->last->rule;
}

/* If the parent has false as its rule, then so do we. */

if (r->last->parent && !r->last->parent->rule)
r->last->rule = 0;

/*
* Determine scope.
* If there is nothing on the line after the conditional,
* not even whitespace, use next-line scope.
* Except that .while does not support next-line scope.
*/

if (buf->buf[pos] == '\0' && tok != ROFF_while) {
r->last->endspan = 2;
goto out;
}

while (buf->buf[pos] == ' ')
pos++;

/* An opening brace requests multiline scope. */

if (buf->buf[pos] == '\\' && buf->buf[pos + 1] == '{') {
r->last->endspan = -1;
pos += 2;
while (buf->buf[pos] == ' ')
	pos++;
goto out;
}

/*
* Anything else following the conditional causes
* single-line scope.  Warn if the scope contains
* nothing but trailing whitespace.
*/

if (buf->buf[pos] == '\0')
mandoc_msg(MANDOCERR_COND_EMPTY,
    ln, ppos, "%s", roff_name[tok]);

r->last->endspan = 1;

2740out:
*offs = pos;
irc = ROFF_RERUN0x002;
if (tok == ROFF_while)
irc |= ROFF_WHILE0x100;
return irc;
2746}

2748static int
2749roff_ds(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
2750{
char		*string;
const char	*name;
size_t		 namesz;

/* Ignore groff compatibility mode for now. */

if (tok == ROFF_ds1)
tok = ROFF_ds;
else if (tok == ROFF_as1)
tok = ROFF_as;

/*
* The first word is the name of the string.
* If it is empty or terminated by an escape sequence,
* abort the `ds' request without defining anything.
*/

name = string = buf->buf + pos;
if (*name == '\0')
return ROFF_IGN0x000;

namesz = roff_getname(r, &string, ln, pos);
switch (name[namesz]) {
case '\\':
return ROFF_IGN0x000;
case '\t':
string = buf->buf + pos + namesz;
break;
default:
break;
}

/* Read past the initial double-quote, if any. */
if (*string == '"')
string++;

/* The rest is the value. */
roff_setstrn(&r->strtab, name, namesz, string, strlen(string),
   ROFF_as == tok);
roff_setstrn(&r->rentab, name, namesz, NULL((void *)0), 0, 0);
return ROFF_IGN0x000;
2792}

2794/*
* Parse a single operator, one or two characters long.
* If the operator is recognized, return success and advance the
* parse point, else return failure and let the parse point unchanged.
*/
2799static int
2800roff_getop(const char *v, int *pos, char *res)
2801{

*res = v[*pos];

switch (*res) {
case '+':
case '-':
case '*':
case '/':
case '%':
case '&':
case ':':
break;
case '<':
switch (v[*pos + 1]) {
case '=':
	*res = 'l';
	(*pos)++;
	break;
case '>':
	*res = '!';
	(*pos)++;
	break;
case '?':
	*res = 'i';
	(*pos)++;
	break;
default:
	break;
}
break;
case '>':
switch (v[*pos + 1]) {
case '=':
	*res = 'g';
	(*pos)++;
	break;
case '?':
	*res = 'a';
	(*pos)++;
	break;
default:
	break;
}
break;
case '=':
if ('=' == v[*pos + 1])
	(*pos)++;
break;
default:
return 0;
}
(*pos)++;

return *res;
2856}

2858/*
* Evaluate either a parenthesized numeric expression
* or a single signed integer number.
*/
2862static int
2863roff_evalpar(struct roff *r, int ln,
const char *v, int *pos, int *res, int flags)
2865{

if ('(' != v[*pos])
return roff_getnum(v, pos, res, flags);

(*pos)++;
if ( ! roff_evalnum(r, ln, v, pos, res, flags | ROFFNUM_WHITE(1 << 1)))
return 0;

/*
* Omission of the closing parenthesis
* is an error in validation mode,
* but ignored in evaluation mode.
*/

if (')' == v[*pos])
(*pos)++;
else if (NULL((void *)0) == res)
return 0;

return 1;
2886}

2888/*
* Evaluate a complete numeric expression.
* Proceed left to right, there is no concept of precedence.
*/
2892static int
2893roff_evalnum(struct roff *r, int ln, const char *v,
int *pos, int *res, int flags)
2895{
int		 mypos, operand2;
char		 operator;

if (NULL((void *)0) == pos) {
mypos = 0;
pos = &mypos;
}

if (flags & ROFFNUM_WHITE(1 << 1))
while (isspace((unsigned char)v[*pos]))
	(*pos)++;

if ( ! roff_evalpar(r, ln, v, pos, res, flags))
return 0;

while (1) {
if (flags & ROFFNUM_WHITE(1 << 1))
	while (isspace((unsigned char)v[*pos]))
		(*pos)++;

if ( ! roff_getop(v, pos, &operator))
	break;

if (flags & ROFFNUM_WHITE(1 << 1))
	while (isspace((unsigned char)v[*pos]))
		(*pos)++;

if ( ! roff_evalpar(r, ln, v, pos, &operand2, flags))
	return 0;

if (flags & ROFFNUM_WHITE(1 << 1))
	while (isspace((unsigned char)v[*pos]))
		(*pos)++;

if (NULL((void *)0) == res)
	continue;

switch (operator) {
case '+':
	*res += operand2;
	break;
case '-':
	*res -= operand2;
	break;
case '*':
	*res *= operand2;
	break;
case '/':
	if (operand2 == 0) {
		mandoc_msg(MANDOCERR_DIVZERO,
			ln, *pos, "%s", v);
		*res = 0;
		break;
	}
	*res /= operand2;
	break;
case '%':
	if (operand2 == 0) {
		mandoc_msg(MANDOCERR_DIVZERO,
			ln, *pos, "%s", v);
		*res = 0;
		break;
	}
	*res %= operand2;
	break;
case '<':
	*res = *res < operand2;
	break;
case '>':
	*res = *res > operand2;
	break;
case 'l':
	*res = *res <= operand2;
	break;
case 'g':
	*res = *res >= operand2;
	break;
case '=':
	*res = *res == operand2;
	break;
case '!':
	*res = *res != operand2;
	break;
case '&':
	*res = *res && operand2;
	break;
case ':':
	*res = *res || operand2;
	break;
case 'i':
	if (operand2 < *res)
		*res = operand2;
	break;
case 'a':
	if (operand2 > *res)
		*res = operand2;
	break;
default:
	abort();
}
}
return 1;
2998}

3000/* --- register management ------------------------------------------------ */

3002void
3003roff_setreg(struct roff *r, const char *name, int val, char sign)
3004{
roff_setregn(r, name, strlen(name), val, sign, INT_MIN(-0x7fffffff-1));
3006}

3008static void
3009roff_setregn(struct roff *r, const char *name, size_t len,
  int val, char sign, int step)
3011{
struct roffreg	*reg;

/* Search for an existing register with the same name. */
reg = r->regtab;

while (reg != NULL((void *)0) && (reg->key.sz != len ||
   strncmp(reg->key.p, name, len) != 0))
reg = reg->next;

if (NULL((void *)0) == reg) {
/* Create a new register. */
reg = mandoc_malloc(sizeof(struct roffreg));
reg->key.p = mandoc_strndup(name, len);
reg->key.sz = len;
reg->val = 0;
reg->step = 0;
reg->next = r->regtab;
r->regtab = reg;
}

if ('+' == sign)
reg->val += val;
else if ('-' == sign)
reg->val -= val;
else
reg->val = val;
if (step != INT_MIN(-0x7fffffff-1))
reg->step = step;
3040}

3042/*
* Handle some predefined read-only number registers.
* For now, return -1 if the requested register is not predefined;
* in case a predefined read-only register having the value -1
* were to turn up, another special value would have to be chosen.
*/
3048static int
3049roff_getregro(const struct roff *r, const char *name)
3050{

switch (*name) {
case '$':  /* Number of arguments of the last macro evaluated. */
return r->mstackpos < 0 ? 0 : r->mstack[r->mstackpos].argc;
case 'A':  /* ASCII approximation mode is always off. */
return 0;
case 'g':  /* Groff compatibility mode is always on. */
return 1;
case 'H':  /* Fixed horizontal resolution. */
return 24;
case 'j':  /* Always adjust left margin only. */
return 0;
case 'T':  /* Some output device is always defined. */
return 1;
case 'V':  /* Fixed vertical resolution. */
return 40;
default:
return -1;
}
3070}

3072int
3073roff_getreg(struct roff *r, const char *name)
3074{
return roff_getregn(r, name, strlen(name), '\0');
3076}

3078static int
3079roff_getregn(struct roff *r, const char *name, size_t len, char sign)
3080{
struct roffreg	*reg;
int		 val;

if ('.' == name[0] && 2 == len) {
val = roff_getregro(r, name + 1);
if (-1 != val)
	return val;
}

for (reg = r->regtab; reg; reg = reg->next) {
if (len == reg->key.sz &&
    0 == strncmp(name, reg->key.p, len)) {
	switch (sign) {
	case '+':
		reg->val += reg->step;
		break;
	case '-':
		reg->val -= reg->step;
		break;
	default:
		break;
	}
	return reg->val;
}
}

roff_setregn(r, name, len, 0, '\0', INT_MIN(-0x7fffffff-1));
return 0;
3109}

3111static int
3112roff_hasregn(const struct roff *r, const char *name, size_t len)
3113{
struct roffreg	*reg;
int		 val;

if ('.' == name[0] && 2 == len) {
val = roff_getregro(r, name + 1);
if (-1 != val)
	return 1;
}

for (reg = r->regtab; reg; reg = reg->next)
if (len == reg->key.sz &&
    0 == strncmp(name, reg->key.p, len))
	return 1;

return 0;
3129}

3131static void
3132roff_freereg(struct roffreg *reg)
3133{
struct roffreg	*old_reg;

while (NULL((void *)0) != reg) {
free(reg->key.p);
old_reg = reg;
reg = reg->next;
free(old_reg);
}
3142}

3144static int
3145roff_nr(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3146{
char		*key, *val, *step;
size_t		 keysz;
int		 iv, is, len;
char		 sign;

key = val = buf->buf + pos;
if (*key == '\0')
return ROFF_IGN0x000;

keysz = roff_getname(r, &val, ln, pos);
if (key[keysz] == '\\' || key[keysz] == '\t')
return ROFF_IGN0x000;

sign = *val;
if (sign == '+' || sign == '-')
val++;

len = 0;
if (roff_evalnum(r, ln, val, &len, &iv, ROFFNUM_SCALE(1 << 0)) == 0)
return ROFF_IGN0x000;

step = val + len;
while (isspace((unsigned char)*step))
step++;
if (roff_evalnum(r, ln, step, NULL((void *)0), &is, 0) == 0)
is = INT_MIN(-0x7fffffff-1);

roff_setregn(r, key, keysz, iv, sign, is);
return ROFF_IGN0x000;
3176}

3178static int
3179roff_rr(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3180{
struct roffreg	*reg, **prev;
char		*name, *cp;
size_t		 namesz;

name = cp = buf->buf + pos;
if (*name == '\0')
return ROFF_IGN0x000;
namesz = roff_getname(r, &cp, ln, pos);
name[namesz] = '\0';

prev = &r->regtab;
while (1) {
reg = *prev;
if (reg == NULL((void *)0) || !strcmp(name, reg->key.p))
	break;
prev = &reg->next;
}
if (reg != NULL((void *)0)) {
*prev = reg->next;
free(reg->key.p);
free(reg);
}
return ROFF_IGN0x000;
3204}

3206/* --- handler functions for roff requests -------------------------------- */

3208static int
3209roff_rm(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3210{
const char	 *name;
char		 *cp;
size_t		  namesz;

cp = buf->buf + pos;
while (*cp != '\0') {
name = cp;
namesz = roff_getname(r, &cp, ln, (int)(cp - buf->buf));
roff_setstrn(&r->strtab, name, namesz, NULL((void *)0), 0, 0);
roff_setstrn(&r->rentab, name, namesz, NULL((void *)0), 0, 0);
if (name[namesz] == '\\' || name[namesz] == '\t')
	break;
}
return ROFF_IGN0x000;
3225}

3227static int
3228roff_it(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3229{
int		 iv;

/* Parse the number of lines. */

if ( ! roff_evalnum(r, ln, buf->buf, &pos, &iv, 0)) {
mandoc_msg(MANDOCERR_IT_NONUM,
    ln, ppos, "%s", buf->buf + 1);
return ROFF_IGN0x000;
}

while (isspace((unsigned char)buf->buf[pos]))
pos++;

/*
* Arm the input line trap.
* Special-casing "an-trap" is an ugly workaround to cope
* with DocBook stupidly fiddling with man(7) internals.
*/

roffit_lines = iv;
roffit_macro = mandoc_strdup(iv != 1 ||
   strcmp(buf->buf + pos, "an-trap") ?
   buf->buf + pos : "br");
return ROFF_IGN0x000;
3254}

3256static int
3257roff_Dd(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3258{
int		 mask;
enum roff_tok	 t, te;

switch (tok) {
case ROFF_Dd:
tok = MDOC_Dd;
te = MDOC_MAX;
if (r->format == 0)
	r->format = MPARSE_MDOC(1 << 0);
mask = MPARSE_MDOC(1 << 0) | MPARSE_QUICK(1 << 3);
break;
case ROFF_TH:
tok = MAN_TH;
te = MAN_MAX;
if (r->format == 0)
	r->format = MPARSE_MAN(1 << 1);
mask = MPARSE_QUICK(1 << 3);
break;
default:
abort();
}
if ((r->options & mask) == 0)
for (t = tok; t < te; t++)
	roff_setstr(r, roff_name[t], NULL((void *)0), 0);
return ROFF_CONT0x001;
3284}

3286static int
3287roff_TE(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3288{
r->man->flags &= ~ROFF_NONOFILL(1 << 16);
if (r->tbl == NULL((void *)0)) {
mandoc_msg(MANDOCERR_BLK_NOTOPEN, ln, ppos, "TE");
return ROFF_IGN0x000;
}
if (tbl_end(r->tbl, 0) == 0) {
r->tbl = NULL((void *)0);
free(buf->buf);
buf->buf = mandoc_strdup(".sp");
buf->sz = 4;
*offs = 0;
return ROFF_REPARSE0x004;
}
r->tbl = NULL((void *)0);
return ROFF_IGN0x000;
3304}

3306static int
3307roff_T_(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3308{

if (NULL((void *)0) == r->tbl)
mandoc_msg(MANDOCERR_BLK_NOTOPEN, ln, ppos, "T&");
else
tbl_restart(ln, ppos, r->tbl);

return ROFF_IGN0x000;
3316}

3318/*
* Handle in-line equation delimiters.
*/
3321static int
3322roff_eqndelim(struct roff *r, struct buf *buf, int pos)
3323{
char		*cp1, *cp2;
const char	*bef_pr, *bef_nl, *mac, *aft_nl, *aft_pr;

/*
* Outside equations, look for an opening delimiter.
* If we are inside an equation, we already know it is
* in-line, or this function wouldn't have been called;
* so look for a closing delimiter.
*/

cp1 = buf->buf + pos;
cp2 = strchr(cp1, r->eqn == NULL((void *)0) ?
   r->last_eqn->odelim : r->last_eqn->cdelim);
if (cp2 == NULL((void *)0))
return ROFF_CONT0x001;

*cp2++ = '\0';
bef_pr = bef_nl = aft_nl = aft_pr = "";

/* Handle preceding text, protecting whitespace. */

if (*buf->buf != '\0') {
if (r->eqn == NULL((void *)0))
	bef_pr = "\\&";
bef_nl = "\n";
}

/*
* Prepare replacing the delimiter with an equation macro
* and drop leading white space from the equation.
*/

if (r->eqn == NULL((void *)0)) {
while (*cp2 == ' ')
	cp2++;
mac = ".EQ";
} else
mac = ".EN";

/* Handle following text, protecting whitespace. */

if (*cp2 != '\0') {
aft_nl = "\n";
if (r->eqn != NULL((void *)0))
	aft_pr = "\\&";
}

/* Do the actual replacement. */

buf->sz = mandoc_asprintf(&cp1, "%s%s%s%s%s%s%s", buf->buf,
   bef_pr, bef_nl, mac, aft_nl, aft_pr, cp2) + 1;
free(buf->buf);
buf->buf = cp1;

/* Toggle the in-line state of the eqn subsystem. */

r->eqn_inline = r->eqn == NULL((void *)0);
return ROFF_REPARSE0x004;
3382}

3384static int
3385roff_EQ(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3386{
struct roff_node	*n;

if (r->man->meta.macroset == MACROSET_MAN)
man_breakscope(r->man, ROFF_EQ);
n = roff_node_alloc(r->man, ln, ppos, ROFFT_EQN, TOKEN_NONE);
if (ln > r->man->last->line)
n->flags |= NODE_LINE(1 << 3);
n->eqn = eqn_box_new();
roff_node_append(r->man, n);
r->man->next = ROFF_NEXT_SIBLING;

assert(r->eqn == NULL)((r->eqn == ((void *)0)) ? (void)0 : __assert2("/usr/src/usr.bin/mandoc/roff.c"
, 3398, __func__, "r->eqn == NULL"));
if (r->last_eqn == NULL((void *)0))
r->last_eqn = eqn_alloc();
else
eqn_reset(r->last_eqn);
r->eqn = r->last_eqn;
r->eqn->node = n;

if (buf->buf[pos] != '\0')
mandoc_msg(MANDOCERR_ARG_SKIP, ln, pos,
    ".EQ %s", buf->buf + pos);

return ROFF_IGN0x000;
3411}

3413static int
3414roff_EN(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3415{
if (r->eqn != NULL((void *)0)) {
eqn_parse(r->eqn);
r->eqn = NULL((void *)0);
} else
mandoc_msg(MANDOCERR_BLK_NOTOPEN, ln, ppos, "EN");
if (buf->buf[pos] != '\0')
mandoc_msg(MANDOCERR_ARG_SKIP, ln, pos,
    "EN %s", buf->buf + pos);
return ROFF_IGN0x000;
3425}

3427static int
3428roff_TS(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3429{
if (r->tbl != NULL((void *)0)) {
mandoc_msg(MANDOCERR_BLK_BROKEN, ln, ppos, "TS breaks TS");
tbl_end(r->tbl, 0);
}
r->man->flags |= ROFF_NONOFILL(1 << 16);
r->tbl = tbl_alloc(ppos, ln, r->last_tbl);
if (r->last_tbl == NULL((void *)0))
r->first_tbl = r->tbl;
r->last_tbl = r->tbl;
return ROFF_IGN0x000;
3440}

3442static int
3443roff_noarg(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3444{
if (r->man->flags & (MAN_BLINE(1 << 12) | MAN_ELINE(1 << 11)))
man_breakscope(r->man, tok);
if (tok == ROFF_brp)
tok = ROFF_br;
roff_elem_alloc(r->man, ln, ppos, tok);
if (buf->buf[pos] != '\0')
mandoc_msg(MANDOCERR_ARG_SKIP, ln, pos,
   "%s %s", roff_name[tok], buf->buf + pos);
if (tok == ROFF_nf)
r->man->flags |= ROFF_NOFILL(1 << 1);
else if (tok == ROFF_fi)
r->man->flags &= ~ROFF_NOFILL(1 << 1);
r->man->last->flags |= NODE_LINE(1 << 3) | NODE_VALID(1 << 0) | NODE_ENDED(1 << 1);
r->man->next = ROFF_NEXT_SIBLING;
return ROFF_IGN0x000;
3460}

3462static int
3463roff_onearg(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3464{
struct roff_node	*n;
char			*cp;
int			 npos;

if (r->man->flags & (MAN_BLINE(1 << 12) | MAN_ELINE(1 << 11)) &&
   (tok == ROFF_ce || tok == ROFF_rj || tok == ROFF_sp ||
    tok == ROFF_ti))
man_breakscope(r->man, tok);

if (roffce_node != NULL((void *)0) && (tok == ROFF_ce || tok == ROFF_rj)) {
r->man->last = roffce_node;
r->man->next = ROFF_NEXT_SIBLING;
}

roff_elem_alloc(r->man, ln, ppos, tok);
n = r->man->last;

cp = buf->buf + pos;
if (*cp != '\0') {
while (*cp != '\0' && *cp != ' ')
	cp++;
while (*cp == ' ')
	*cp++ = '\0';
if (*cp != '\0')
	mandoc_msg(MANDOCERR_ARG_EXCESS,
	    ln, (int)(cp - buf->buf),
	    "%s ... %s", roff_name[tok], cp);
roff_word_alloc(r->man, ln, pos, buf->buf + pos);
}

if (tok == ROFF_ce || tok == ROFF_rj) {
if (r->man->last->type == ROFFT_ELEM) {
	roff_word_alloc(r->man, ln, pos, "1");
	r->man->last->flags |= NODE_NOSRC(1 << 9);
}
npos = 0;
if (roff_evalnum(r, ln, r->man->last->string, &npos,
    &roffce_lines, 0) == 0) {
	mandoc_msg(MANDOCERR_CE_NONUM,
	    ln, pos, "ce %s", buf->buf + pos);
	roffce_lines = 1;
}
if (roffce_lines < 1) {
	r->man->last = r->man->last->parent;
	roffce_node = NULL((void *)0);
	roffce_lines = 0;
} else
	roffce_node = r->man->last->parent;
} else {
n->flags |= NODE_VALID(1 << 0) | NODE_ENDED(1 << 1);
r->man->last = n;
}
n->flags |= NODE_LINE(1 << 3);
r->man->next = ROFF_NEXT_SIBLING;
return ROFF_IGN0x000;
3520}

3522static int
3523roff_manyarg(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3524{
struct roff_node	*n;
char			*sp, *ep;

roff_elem_alloc(r->man, ln, ppos, tok);
n = r->man->last;

for (sp = ep = buf->buf + pos; *sp != '\0'; sp = ep) {
while (*ep != '\0' && *ep != ' ')
	ep++;
while (*ep == ' ')
	*ep++ = '\0';
roff_word_alloc(r->man, ln, sp - buf->buf, sp);
}

n->flags |= NODE_LINE(1 << 3) | NODE_VALID(1 << 0) | NODE_ENDED(1 << 1);
r->man->last = n;
r->man->next = ROFF_NEXT_SIBLING;
return ROFF_IGN0x000;
3543}

3545static int
3546roff_als(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3547{
char		*oldn, *newn, *end, *value;
size_t		 oldsz, newsz, valsz;

newn = oldn = buf->buf + pos;
if (*newn == '\0')
return ROFF_IGN0x000;

newsz = roff_getname(r, &oldn, ln, pos);
if (newn[newsz] == '\\' || newn[newsz] == '\t' || *oldn == '\0')
return ROFF_IGN0x000;

end = oldn;
oldsz = roff_getname(r, &end, ln, oldn - buf->buf);
if (oldsz == 0)
return ROFF_IGN0x000;

valsz = mandoc_asprintf(&value, ".%.*s \\$@\\\"\n",
   (int)oldsz, oldn);
roff_setstrn(&r->strtab, newn, newsz, value, valsz, 0);
roff_setstrn(&r->rentab, newn, newsz, NULL((void *)0), 0, 0);
free(value);
return ROFF_IGN0x000;
3570}

3572/*
* The .break request only makes sense inside conditionals,
* and that case is already handled in roff_cond_sub().
*/
3576static int
3577roff_break(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3578{
mandoc_msg(MANDOCERR_BLK_NOTOPEN, ln, pos, "break");
return ROFF_IGN0x000;
3581}

3583static int
3584roff_cc(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3585{
const char	*p;

p = buf->buf + pos;

if (*p == '\0' || (r->control = *p++) == '.')
r->control = '\0';

if (*p != '\0')
mandoc_msg(MANDOCERR_ARG_EXCESS,
    ln, p - buf->buf, "cc ... %s", p);

return ROFF_IGN0x000;
3598}

3600static int
3601roff_char(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3602{
const char	*p, *kp, *vp;
size_t		 ksz, vsz;
int		 font;

/* Parse the character to be replaced. */

kp = buf->buf + pos;
p = kp + 1;
if (*kp == '\0' || (*kp == '\\' &&
    mandoc_escape(&p, NULL((void *)0), NULL((void *)0)) != ESCAPE_SPECIAL) ||
   (*p != ' ' && *p != '\0')) {
mandoc_msg(MANDOCERR_CHAR_ARG, ln, pos, "char %s", kp);
return ROFF_IGN0x000;
}
ksz = p - kp;
while (*p == ' ')
p++;

/*
* If the replacement string contains a font escape sequence,
* we have to restore the font at the end.
*/

vp = p;
vsz = strlen(p);
font = 0;
while (*p != '\0') {
if (*p++ != '\\')
	continue;
switch (mandoc_escape(&p, NULL((void *)0), NULL((void *)0))) {
case ESCAPE_FONT:
case ESCAPE_FONTROMAN:
case ESCAPE_FONTITALIC:
case ESCAPE_FONTBOLD:
case ESCAPE_FONTBI:
case ESCAPE_FONTCR:
case ESCAPE_FONTCB:
case ESCAPE_FONTCI:
case ESCAPE_FONTPREV:
	font++;
	break;
default:
	break;
}
}
if (font > 1)
mandoc_msg(MANDOCERR_CHAR_FONT,
    ln, (int)(vp - buf->buf), "%s", vp);

/*
* Approximate the effect of .char using the .tr tables.
* XXX In groff, .char and .tr interact differently.
*/

if (ksz == 1) {
if (r->xtab == NULL((void *)0))
	r->xtab = mandoc_calloc(128, sizeof(*r->xtab));
assert((unsigned int)*kp < 128)(((unsigned int)*kp < 128) ? (void)0 : __assert2("/usr/src/usr.bin/mandoc/roff.c"
, 3660, __func__, "(unsigned int)*kp < 128"));
free(r->xtab[(int)*kp].p);
r->xtab[(int)*kp].sz = mandoc_asprintf(&r->xtab[(int)*kp].p,
    "%s%s", vp, font ? "\fP" : "");
} else {
roff_setstrn(&r->xmbtab, kp, ksz, vp, vsz, 0);
if (font)
	roff_setstrn(&r->xmbtab, kp, ksz, "\\fP", 3, 1);
}
return ROFF_IGN0x000;
3670}

3672static int
3673roff_ec(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3674{
const char	*p;

p = buf->buf + pos;
if (*p == '\0')
r->escape = '\\';
else {
r->escape = *p;
if (*++p != '\0')
	mandoc_msg(MANDOCERR_ARG_EXCESS, ln,
	    (int)(p - buf->buf), "ec ... %s", p);
}
return ROFF_IGN0x000;
3687}

3689static int
3690roff_eo(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3691{
r->escape = '\0';
if (buf->buf[pos] != '\0')
mandoc_msg(MANDOCERR_ARG_SKIP,
    ln, pos, "eo %s", buf->buf + pos);
return ROFF_IGN0x000;
3697}

3699static int
3700roff_mc(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3701{
struct roff_node	*n;
char			*cp;

/* Parse the first argument. */

cp = buf->buf + pos;
if (*cp != '\0')
cp++;
if (buf->buf[pos] == '\\') {
switch (mandoc_escape((const char **)&cp, NULL((void *)0), NULL((void *)0))) {
case ESCAPE_SPECIAL:
case ESCAPE_UNICODE:
case ESCAPE_NUMBERED:
	break;
default:
	*cp = '\0';
	mandoc_msg(MANDOCERR_MC_ESC, ln, pos,
	    "mc %s", buf->buf + pos);
	buf->buf[pos] = '\0';
	break;
}
}

/* Ignore additional arguments. */

while (*cp == ' ')
*cp++ = '\0';
if (*cp != '\0') {
mandoc_msg(MANDOCERR_MC_DIST, ln, (int)(cp - buf->buf),
    "mc ... %s", cp);
*cp = '\0';
}

/* Create the .mc node. */

roff_elem_alloc(r->man, ln, ppos, tok);
n = r->man->last;
if (buf->buf[pos] != '\0')
roff_word_alloc(r->man, ln, pos, buf->buf + pos);
n->flags |= NODE_LINE(1 << 3) | NODE_VALID(1 << 0) | NODE_ENDED(1 << 1);
r->man->last = n;
r->man->next = ROFF_NEXT_SIBLING;
return ROFF_IGN0x000;
3745}

3747static int
3748roff_nop(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3749{
while (buf->buf[pos] == ' ')
pos++;
*offs = pos;
return ROFF_RERUN0x002;
3754}

3756static int
3757roff_tr(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3758{
const char	*p, *first, *second;
size_t		 fsz, ssz;

p = buf->buf + pos;

if (*p == '\0') {
mandoc_msg(MANDOCERR_REQ_EMPTY, ln, ppos, "tr");
return ROFF_IGN0x000;
}

while (*p != '\0') {
fsz = ssz = 1;

first = p++;
if (*first == '\\') {
	if (mandoc_escape(&p, NULL((void *)0), NULL((void *)0)) == ESCAPE_ERROR)
		return ROFF_IGN0x000;
	fsz = (size_t)(p - first);
}

second = p++;
if (*second == '\\') {
	if (mandoc_escape(&p, NULL((void *)0), NULL((void *)0)) == ESCAPE_ERROR)
		return ROFF_IGN0x000;
	ssz = (size_t)(p - second);
} else if (*second == '\0') {
	mandoc_msg(MANDOCERR_TR_ODD, ln,
	    (int)(first - buf->buf), "tr %s", first);
	second = " ";
	p--;
}

if (fsz > 1) {
	roff_setstrn(&r->xmbtab, first, fsz,
	    second, ssz, 0);
	continue;
}

if (r->xtab == NULL((void *)0))
	r->xtab = mandoc_calloc(128,
	    sizeof(struct roffstr));

free(r->xtab[(int)*first].p);
r->xtab[(int)*first].p = mandoc_strndup(second, ssz);
r->xtab[(int)*first].sz = ssz;
}

return ROFF_IGN0x000;
3807}

3809/*
* Implementation of the .return request.
* There is no need to call roff_userret() from here.
* The read module will call that after rewinding the reader stack
* to the place from where the current macro was called.
*/
3815static int
3816roff_return(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3817{
if (r->mstackpos >= 0)
return ROFF_IGN0x000 | ROFF_USERRET0x040;

mandoc_msg(MANDOCERR_REQ_NOMAC, ln, ppos, "return");
return ROFF_IGN0x000;
3823}

3825static int
3826roff_rn(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3827{
const char	*value;
char		*oldn, *newn, *end;
size_t		 oldsz, newsz;
int		 deftype;

oldn = newn = buf->buf + pos;
if (*oldn == '\0')
return ROFF_IGN0x000;

oldsz = roff_getname(r, &newn, ln, pos);
if (oldn[oldsz] == '\\' || oldn[oldsz] == '\t' || *newn == '\0')
return ROFF_IGN0x000;

end = newn;
newsz = roff_getname(r, &end, ln, newn - buf->buf);
if (newsz == 0)
return ROFF_IGN0x000;

deftype = ROFFDEF_ANY((1 << 1) | (1 << 2) | (1 << 3) | (1 <<
 4));
value = roff_getstrn(r, oldn, oldsz, &deftype);
switch (deftype) {
case ROFFDEF_USER(1 << 1):
roff_setstrn(&r->strtab, newn, newsz, value, strlen(value), 0);
roff_setstrn(&r->strtab, oldn, oldsz, NULL((void *)0), 0, 0);
roff_setstrn(&r->rentab, newn, newsz, NULL((void *)0), 0, 0);
break;
case ROFFDEF_PRE(1 << 2):
roff_setstrn(&r->strtab, newn, newsz, value, strlen(value), 0);
roff_setstrn(&r->rentab, newn, newsz, NULL((void *)0), 0, 0);
break;
case ROFFDEF_REN(1 << 3):
roff_setstrn(&r->rentab, newn, newsz, value, strlen(value), 0);
roff_setstrn(&r->rentab, oldn, oldsz, NULL((void *)0), 0, 0);
roff_setstrn(&r->strtab, newn, newsz, NULL((void *)0), 0, 0);
break;
case ROFFDEF_STD(1 << 4):
roff_setstrn(&r->rentab, newn, newsz, oldn, oldsz, 0);
roff_setstrn(&r->strtab, newn, newsz, NULL((void *)0), 0, 0);
break;
default:
roff_setstrn(&r->strtab, newn, newsz, NULL((void *)0), 0, 0);
roff_setstrn(&r->rentab, newn, newsz, NULL((void *)0), 0, 0);
break;
}
return ROFF_IGN0x000;
3873}

3875static int
3876roff_shift(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3877{
struct mctx	*ctx;
int		 argpos, levels, i;

argpos = pos;
levels = 1;
if (buf->buf[pos] != '\0' &&
   roff_evalnum(r, ln, buf->buf, &pos, &levels, 0) == 0) {
mandoc_msg(MANDOCERR_CE_NONUM,
    ln, pos, "shift %s", buf->buf + pos);
levels = 1;
}
if (r->mstackpos < 0) {
mandoc_msg(MANDOCERR_REQ_NOMAC, ln, ppos, "shift");
return ROFF_IGN0x000;
}
ctx = r->mstack + r->mstackpos;
if (levels > ctx->argc) {
mandoc_msg(MANDOCERR_SHIFT,
    ln, argpos, "%d, but max is %d", levels, ctx->argc);
levels = ctx->argc;
}
if (levels < 0) {
mandoc_msg(MANDOCERR_ARG_NEG, ln, argpos, "shift %d", levels);
levels = 0;
}
if (levels == 0)
return ROFF_IGN0x000;
for (i = 0; i < levels; i++)
free(ctx->argv[i]);
ctx->argc -= levels;
for (i = 0; i < ctx->argc; i++)
ctx->argv[i] = ctx->argv[i + levels];
return ROFF_IGN0x000;
3911}

3913static int
3914roff_so(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3915{
char *name, *cp;

name = buf->buf + pos;
mandoc_msg(MANDOCERR_SO, ln, ppos, "so %s", name);

/*
* Handle `so'.  Be EXTREMELY careful, as we shouldn't be
* opening anything that's not in our cwd or anything beneath
* it.  Thus, explicitly disallow traversing up the file-system
* or using absolute paths.
*/

if (*name == '/' || strstr(name, "../") || strstr(name, "/..")) {
mandoc_msg(MANDOCERR_SO_PATH, ln, ppos, ".so %s", name);
buf->sz = mandoc_asprintf(&cp,
    ".sp\nSee the file %s.\n.sp", name) + 1;
free(buf->buf);
buf->buf = cp;
*offs = 0;
return ROFF_REPARSE0x004;
}

*offs = pos;
return ROFF_SO0x008;
3940}

3942/* --- user defined strings and macros ------------------------------------ */

3944static int
3945roff_userdef(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
3946{
struct mctx	 *ctx;
char		 *arg, *ap, *dst, *src;
size_t		  sz;

/* If the macro is empty, ignore it altogether. */

if (*r->current_string == '\0')
return ROFF_IGN0x000;

/* Initialize a new macro stack context. */

if (++r->mstackpos == r->mstacksz) {
r->mstack = mandoc_recallocarray(r->mstack,
    r->mstacksz, r->mstacksz + 8, sizeof(*r->mstack));
r->mstacksz += 8;
}
ctx = r->mstack + r->mstackpos;
ctx->argc = 0;

/*
* Collect pointers to macro argument strings,
* NUL-terminating them and escaping quotes.
*/

src = buf->buf + pos;
while (*src != '\0') {
if (ctx->argc == ctx->argsz) {
	ctx->argsz += 8;
	ctx->argv = mandoc_reallocarray(ctx->argv,
	    ctx->argsz, sizeof(*ctx->argv));
}
arg = roff_getarg(r, &src, ln, &pos);
sz = 1;  /* For the terminating NUL. */
for (ap = arg; *ap != '\0'; ap++)
	sz += *ap == '"' ? 4 : 1;
ctx->argv[ctx->argc++] = dst = mandoc_malloc(sz);
for (ap = arg; *ap != '\0'; ap++) {
	if (*ap == '"') {
		memcpy(dst, "\\(dq", 4);
		dst += 4;
	} else
		*dst++ = *ap;
}
*dst = '\0';
free(arg);
}

/* Replace the macro invocation by the macro definition. */

free(buf->buf);
buf->buf = mandoc_strdup(r->current_string);
buf->sz = strlen(buf->buf) + 1;
*offs = 0;

return buf->buf[buf->sz - 2] == '\n' ?
   ROFF_REPARSE0x004 | ROFF_USERCALL0x020 : ROFF_IGN0x000 | ROFF_APPEND0x010;
4003}

4005/*
* Calling a high-level macro that was renamed with .rn.
* r->current_string has already been set up by roff_parse().
*/
4009static int
4010roff_renamed(ROFF_ARGSstruct roff *r, enum roff_tok tok, struct buf *buf, int ln, int
 ppos, int pos, int *offs)
4011{
char	*nbuf;

buf->sz = mandoc_asprintf(&nbuf, ".%s%s%s", r->current_string,
   buf->buf[pos] == '\0' ? "" : " ", buf->buf + pos) + 1;
free(buf->buf);
buf->buf = nbuf;
*offs = 0;
return ROFF_CONT0x001;
4020}

4022/*
* Measure the length in bytes of the roff identifier at *cpp
* and advance the pointer to the next word.
*/
4026static size_t
4027roff_getname(struct roff *r, char **cpp, int ln, int pos)
4028{
char	 *name, *cp;
int	  namesz, inam, iend;

name = *cpp;
if (*name == '\0')
return 0;

/* Advance cp to the byte after the end of the name. */

cp = name;
namesz = 0;
for (;;) {
if (*cp == '\0')
	break;
if (*cp == ' ' || *cp == '\t') {
	cp++;
	break;
}
if (*cp != '\\') {
	if (name + namesz < cp) {
		name[namesz] = *cp;
		*cp = ' ';
	}
	namesz++;
	cp++;
	continue;
}
if (cp[1] == '{' || cp[1] == '}')
	break;
if (roff_escape(cp, 0, 0, NULL((void *)0), &inam,
    NULL((void *)0), NULL((void *)0), &iend) != ESCAPE_UNDEF) {
	mandoc_msg(MANDOCERR_NAMESC, ln, pos,
	    "%.*s%.*s", namesz, name, iend, cp);
	cp += iend;
	break;
}

/*
 * In an identifier, \\, \., \G and so on
 * are reduced to \, ., G and so on,
 * vaguely similar to copy mode.
 */

name[namesz++] = cp[inam];
while (iend--) {
	if (cp >= name + namesz)
		*cp = ' ';
	cp++;
}
}

/* Read past spaces. */

while (*cp == ' ')
cp++;

*cpp = cp;
return namesz;
4087}

4089/*
* Store *string into the user-defined string called *name.
* To clear an existing entry, call with (*r, *name, NULL, 0).
* append == 0: replace mode
* append == 1: single-line append mode
* append == 2: multiline append mode, append '\n' after each call
*/
4096static void
4097roff_setstr(struct roff *r, const char *name, const char *string,
int append)
4099{
size_t	 namesz;

namesz = strlen(name);
roff_setstrn(&r->strtab, name, namesz, string,
   string ? strlen(string) : 0, append);
roff_setstrn(&r->rentab, name, namesz, NULL((void *)0), 0, 0);
4106}

4108static void
4109roff_setstrn(struct roffkv **r, const char *name, size_t namesz,
const char *string, size_t stringsz, int append)
4111{
struct roffkv	*n;
char		*c;
int		 i;
size_t		 oldch, newch;

/* Search for an existing string with the same name. */
n = *r;

while (n && (namesz != n->key.sz ||
	strncmp(n->key.p, name, namesz)))
n = n->next;

if (NULL((void *)0) == n) {
/* Create a new string table entry. */
n = mandoc_malloc(sizeof(struct roffkv));
n->key.p = mandoc_strndup(name, namesz);
n->key.sz = namesz;
n->val.p = NULL((void *)0);
n->val.sz = 0;
n->next = *r;
*r = n;
} else if (0 == append) {
free(n->val.p);
n->val.p = NULL((void *)0);
n->val.sz = 0;
}

if (NULL((void *)0) == string)
return;

/*
* One additional byte for the '\n' in multiline mode,
* and one for the terminating '\0'.
*/
newch = stringsz + (1 < append ? 2u : 1u);

if (NULL((void *)0) == n->val.p) {
n->val.p = mandoc_malloc(newch);
*n->val.p = '\0';
oldch = 0;
} else {
oldch = n->val.sz;
n->val.p = mandoc_realloc(n->val.p, oldch + newch);
}

/* Skip existing content in the destination buffer. */
c = n->val.p + (int)oldch;

/* Append new content to the destination buffer. */
i = 0;
while (i < (int)stringsz) {
/*
 * Rudimentary roff copy mode:
 * Handle escaped backslashes.
 */
if ('\\' == string[i] && '\\' == string[i + 1])
	i++;
*c++ = string[i++];
}

/* Append terminating bytes. */
if (1 < append)
*c++ = '\n';

*c = '\0';
n->val.sz = (int)(c - n->val.p);
4178}

4180static const char *
4181roff_getstrn(struct roff *r, const char *name, size_t len,
  int *deftype)
4183{
const struct roffkv	*n;
int			 found, i;
enum roff_tok		 tok;

found = 0;
for (n = r->strtab; n != NULL((void *)0); n = n->next) {
if (strncmp(name, n->key.p, len) != 0 ||
    n->key.p[len] != '\0' || n->val.p == NULL((void *)0))
	continue;
if (*deftype & ROFFDEF_USER(1 << 1)) {
	*deftype = ROFFDEF_USER(1 << 1);
	return n->val.p;
} else {
	found = 1;
	break;
}
}
for (n = r->rentab; n != NULL((void *)0); n = n->next) {
if (strncmp(name, n->key.p, len) != 0 ||
    n->key.p[len] != '\0' || n->val.p == NULL((void *)0))
	continue;
if (*deftype & ROFFDEF_REN(1 << 3)) {
	*deftype = ROFFDEF_REN(1 << 3);
	return n->val.p;
} else {
	found = 1;
	break;
}
}
for (i = 0; i < PREDEFS_MAX38; i++) {
if (strncmp(name, predefs[i].name, len) != 0 ||
    predefs[i].name[len] != '\0')
	continue;
if (*deftype & ROFFDEF_PRE(1 << 2)) {
	*deftype = ROFFDEF_PRE(1 << 2);
	return predefs[i].str;
} else {
	found = 1;
	break;
}
}
if (r->man->meta.macroset != MACROSET_MAN) {
for (tok = MDOC_Dd; tok < MDOC_MAX; tok++) {
	if (strncmp(name, roff_name[tok], len) != 0 ||
	    roff_name[tok][len] != '\0')
		continue;
	if (*deftype & ROFFDEF_STD(1 << 4)) {
		*deftype = ROFFDEF_STD(1 << 4);
		return NULL((void *)0);
	} else {
		found = 1;
		break;
	}
}
}
if (r->man->meta.macroset != MACROSET_MDOC) {
for (tok = MAN_TH; tok < MAN_MAX; tok++) {
	if (strncmp(name, roff_name[tok], len) != 0 ||
	    roff_name[tok][len] != '\0')
		continue;
	if (*deftype & ROFFDEF_STD(1 << 4)) {
		*deftype = ROFFDEF_STD(1 << 4);
		return NULL((void *)0);
	} else {
		found = 1;
		break;
	}
}
}

if (found == 0 && *deftype != ROFFDEF_ANY((1 << 1) | (1 << 2) | (1 << 3) | (1 <<
 4))) {
if (*deftype & ROFFDEF_REN(1 << 3)) {
	/*
	 * This might still be a request,
	 * so do not treat it as undefined yet.
	 */
	*deftype = ROFFDEF_UNDEF(1 << 5);
	return NULL((void *)0);
}

/* Using an undefined string defines it to be empty. */

roff_setstrn(&r->strtab, name, len, "", 0, 0);
roff_setstrn(&r->rentab, name, len, NULL((void *)0), 0, 0);
}

*deftype = 0;
return NULL((void *)0);
4272}

4274static void
4275roff_freestr(struct roffkv *r)
4276{
struct roffkv	 *n, *nn;

for (n = r; n; n = nn) {
free(n->key.p);
free(n->val.p);
nn = n->next;
free(n);
}
4285}

4287/* --- accessors and utility functions ------------------------------------ */

4289/*
* Duplicate an input string, making the appropriate character
* conversations (as stipulated by `tr') along the way.
* Returns a heap-allocated string with all the replacements made.
*/
4294char *
4295roff_strdup(const struct roff *r, const char *p)
4296{
const struct roffkv *cp;
char		*res;
const char	*pp;
size_t		 ssz, sz;
enum mandoc_esc	 esc;

if (NULL((void *)0) == r->xmbtab && NULL((void *)0) == r->xtab)
return mandoc_strdup(p);
else if ('\0' == *p)
return mandoc_strdup("");

/*
* Step through each character looking for term matches
* (remember that a `tr' can be invoked with an escape, which is
* a glyph but the escape is multi-character).
* We only do this if the character hash has been initialised
* and the string is >0 length.
*/

res = NULL((void *)0);
ssz = 0;

while ('\0' != *p) {
assert((unsigned int)*p < 128)(((unsigned int)*p < 128) ? (void)0 : __assert2("/usr/src/usr.bin/mandoc/roff.c"
, 4320, __func__, "(unsigned int)*p < 128"));
if ('\\' != *p && r->xtab && r->xtab[(unsigned int)*p].p) {
	sz = r->xtab[(int)*p].sz;
	res = mandoc_realloc(res, ssz + sz + 1);
	memcpy(res + ssz, r->xtab[(int)*p].p, sz);
	ssz += sz;
	p++;
	continue;
} else if ('\\' != *p) {
	res = mandoc_realloc(res, ssz + 2);
	res[ssz++] = *p++;
	continue;
}

/* Search for term matches. */
for (cp = r->xmbtab; cp; cp = cp->next)
	if (0 == strncmp(p, cp->key.p, cp->key.sz))
		break;

if (NULL((void *)0) != cp) {
	/*
	 * A match has been found.
	 * Append the match to the array and move
	 * forward by its keysize.
	 */
	res = mandoc_realloc(res,
	    ssz + cp->val.sz + 1);
	memcpy(res + ssz, cp->val.p, cp->val.sz);
	ssz += cp->val.sz;
	p += (int)cp->key.sz;
	continue;
}

/*
 * Handle escapes carefully: we need to copy
 * over just the escape itself, or else we might
 * do replacements within the escape itself.
 * Make sure to pass along the bogus string.
 */
pp = p++;
esc = mandoc_escape(&p, NULL((void *)0), NULL((void *)0));
if (ESCAPE_ERROR == esc) {
	sz = strlen(pp);
	res = mandoc_realloc(res, ssz + sz + 1);
	memcpy(res + ssz, pp, sz);
	break;
}
/*
 * We bail out on bad escapes.
 * No need to warn: we already did so when
 * roff_expand() was called.
 */
sz = (int)(p - pp);
res = mandoc_realloc(res, ssz + sz + 1);
memcpy(res + ssz, pp, sz);
ssz += sz;
}

res[(int)ssz] = '\0';
return res;
4380}

4382int
4383roff_getformat(const struct roff *r)
4384{

return r->format;
4387}

4389/*
* Find out whether a line is a macro line or not.
* If it is, adjust the current position and return one; if it isn't,
* return zero and don't change the current position.
* If the control character has been set with `.cc', then let that grain
* precedence.
* This is slightly contrary to groff, where using the non-breaking
* control character when `cc' has been invoked will cause the
* non-breaking macro contents to be printed verbatim.
*/
4399int
4400roff_getcontrol(const struct roff *r, const char *cp, int *ppos)
4401{
int		pos;

pos = *ppos;

if (r->control != '\0' && cp[pos] == r->control)
pos++;
else if (r->control != '\0')
return 0;
else if ('\\' == cp[pos] && '.' == cp[pos + 1])
pos += 2;
else if ('.' == cp[pos] || '\'' == cp[pos])
pos++;
else
return 0;

while (' ' == cp[pos] || '\t' == cp[pos])
pos++;

*ppos = pos;
return 1;
4422}