===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/mandoc/mandoc.c,v
retrieving revision 1.72
retrieving revision 1.73
diff -c -r1.72 -r1.73
*** src/usr.bin/mandoc/mandoc.c	2018/07/28 18:32:30	1.72
--- src/usr.bin/mandoc/mandoc.c	2018/08/10 22:12:40	1.73
***************
*** 1,4 ****
! /*	$OpenBSD: mandoc.c,v 1.72 2018/07/28 18:32:30 schwarze Exp $ */
  /*
   * Copyright (c) 2008-2011, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
   * Copyright (c) 2011-2015, 2017, 2018 Ingo Schwarze <schwarze@openbsd.org>
--- 1,4 ----
! /*	$OpenBSD: mandoc.c,v 1.73 2018/08/10 22:12:40 schwarze Exp $ */
  /*
   * Copyright (c) 2008-2011, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
   * Copyright (c) 2011-2015, 2017, 2018 Ingo Schwarze <schwarze@openbsd.org>
***************
*** 39,45 ****
  mandoc_escape(const char **end, const char **start, int *sz)
  {
  	const char	*local_start;
! 	int		 local_sz;
  	char		 term;
  	enum mandoc_esc	 gly;
  
--- 39,45 ----
  mandoc_escape(const char **end, const char **start, int *sz)
  {
  	const char	*local_start;
! 	int		 local_sz, c, i;
  	char		 term;
  	enum mandoc_esc	 gly;
  
***************
*** 328,335 ****
  		}
  		break;
  	case ESCAPE_SPECIAL:
! 		if (1 == *sz && 'c' == **start)
! 			gly = ESCAPE_NOSPACE;
  		/*
  		 * Unicode escapes are defined in groff as \[u0000]
  		 * to \[u10FFFF], where the contained value must be
--- 328,353 ----
  		}
  		break;
  	case ESCAPE_SPECIAL:
! 		if (**start == 'c') {
! 			if (*sz == 1) {
! 				gly = ESCAPE_NOSPACE;
! 				break;
! 			}
! 			if (*sz < 6 || *sz > 7 ||
! 			    strncmp(*start, "char", 4) != 0 ||
! 			    (int)strspn(*start + 4, "0123456789") + 4 < *sz)
! 				break;
! 			c = 0;
! 			for (i = 4; i < *sz; i++)
! 				c = 10 * c + ((*start)[i] - '0');
! 			if (c < 0x21 || (c > 0x7e && c < 0xa0) || c > 0xff)
! 				break;
! 			*start += 4;
! 			*sz -= 4;
! 			gly = ESCAPE_NUMBERED;
! 			break;
! 		}
! 
  		/*
  		 * Unicode escapes are defined in groff as \[u0000]
  		 * to \[u10FFFF], where the contained value must be