===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/mandoc/man_term.c,v
retrieving revision 1.116
retrieving revision 1.117
diff -u -r1.116 -r1.117
--- src/usr.bin/mandoc/man_term.c	2014/12/23 13:48:15	1.116
+++ src/usr.bin/mandoc/man_term.c	2014/12/24 09:57:41	1.117
@@ -1,4 +1,4 @@
-/*	$OpenBSD: man_term.c,v 1.116 2014/12/23 13:48:15 schwarze Exp $ */
+/*	$OpenBSD: man_term.c,v 1.117 2014/12/24 09:57:41 schwarze Exp $ */
 /*
  * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010-2014 Ingo Schwarze <schwarze@openbsd.org>
@@ -19,6 +19,7 @@
 
 #include <assert.h>
 #include <ctype.h>
+#include <limits.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -430,6 +431,8 @@
 		p->offset += v;
 	else
 		p->offset = v;
+	if (p->offset > SHRT_MAX)
+		p->offset = term_len(p, p->defindent);
 
 	return(0);
 }
@@ -506,16 +509,16 @@
 	if ((nn = n->parent->head->child) != NULL &&
 	    a2roffsu(nn->string, &su, SCALE_EN)) {
 		len = term_hspan(p, &su);
+		if (len < 0 && (size_t)(-len) > mt->offset)
+			len = -mt->offset;
+		else if (len > SHRT_MAX)
+			len = term_len(p, p->defindent);
 		mt->lmargin[mt->lmargincur] = len;
 	} else
 		len = mt->lmargin[mt->lmargincur];
 
 	p->offset = mt->offset;
-	if (len > 0 || (size_t)(-len) < mt->offset)
-		p->rmargin = mt->offset + len;
-	else
-		p->rmargin = 0;
-
+	p->rmargin = mt->offset + len;
 	return(1);
 }
 
@@ -580,9 +583,11 @@
 	    (nn = nn->next) != NULL &&
 	    a2roffsu(nn->string, &su, SCALE_EN)) {
 		len = term_hspan(p, &su);
-		mt->lmargin[mt->lmargincur] = len;
 		if (len < 0 && (size_t)(-len) > mt->offset)
 			len = -mt->offset;
+		else if (len > SHRT_MAX)
+			len = term_len(p, p->defindent);
+		mt->lmargin[mt->lmargincur] = len;
 	} else
 		len = mt->lmargin[mt->lmargincur];
 
@@ -660,9 +665,11 @@
 	    nn->string != NULL && ! (MAN_LINE & nn->flags) &&
 	    a2roffsu(nn->string, &su, SCALE_EN)) {
 		len = term_hspan(p, &su);
-		mt->lmargin[mt->lmargincur] = len;
 		if (len < 0 && (size_t)(-len) > mt->offset)
 			len = -mt->offset;
+		else if (len > SHRT_MAX)
+			len = term_len(p, p->defindent);
+		mt->lmargin[mt->lmargincur] = len;
 	} else
 		len = mt->lmargin[mt->lmargincur];
 
@@ -843,10 +850,11 @@
 		break;
 	}
 
+	len = SHRT_MAX + 1;
 	if ((n = n->parent->head->child) != NULL &&
 	    a2roffsu(n->string, &su, SCALE_EN))
 		len = term_hspan(p, &su);
-	else
+	if (len > SHRT_MAX)
 		len = term_len(p, p->defindent);
 
 	if (len > 0 || (size_t)(-len) < mt->offset)
@@ -879,10 +887,11 @@
 		break;
 	}
 
+	len = SHRT_MAX + 1;
 	if ((n = n->parent->head->child) != NULL &&
 	    a2roffsu(n->string, &su, SCALE_EN))
 		len = term_hspan(p, &su);
-	else
+	if (len > SHRT_MAX)
 		len = term_len(p, p->defindent);
 
 	if (len < 0 || (size_t)len < mt->offset)