===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/mandoc/roff.c,v
retrieving revision 1.253
retrieving revision 1.254
diff -c -r1.253 -r1.254
*** src/usr.bin/mandoc/roff.c	2022/04/13 13:11:33	1.253
--- src/usr.bin/mandoc/roff.c	2022/04/24 13:34:53	1.254
***************
*** 1,4 ****
! /* $OpenBSD: roff.c,v 1.253 2022/04/13 13:11:33 schwarze Exp $ */
  /*
   * Copyright (c) 2010-2015, 2017-2022 Ingo Schwarze <schwarze@openbsd.org>
   * Copyright (c) 2008-2012, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
--- 1,4 ----
! /* $OpenBSD: roff.c,v 1.254 2022/04/24 13:34:53 schwarze Exp $ */
  /*
   * Copyright (c) 2010-2015, 2017-2022 Ingo Schwarze <schwarze@openbsd.org>
   * Copyright (c) 2008-2012, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
***************
*** 3868,3875 ****
  roff_shift(ROFF_ARGS)
  {
  	struct mctx	*ctx;
! 	int		 levels, i;
  
  	levels = 1;
  	if (buf->buf[pos] != '\0' &&
  	    roff_evalnum(r, ln, buf->buf, &pos, &levels, 0) == 0) {
--- 3868,3876 ----
  roff_shift(ROFF_ARGS)
  {
  	struct mctx	*ctx;
! 	int		 argpos, levels, i;
  
+ 	argpos = pos;
  	levels = 1;
  	if (buf->buf[pos] != '\0' &&
  	    roff_evalnum(r, ln, buf->buf, &pos, &levels, 0) == 0) {
***************
*** 3884,3891 ****
  	ctx = r->mstack + r->mstackpos;
  	if (levels > ctx->argc) {
  		mandoc_msg(MANDOCERR_SHIFT,
! 		    ln, pos, "%d, but max is %d", levels, ctx->argc);
  		levels = ctx->argc;
  	}
  	if (levels == 0)
  		return ROFF_IGN;
--- 3885,3896 ----
  	ctx = r->mstack + r->mstackpos;
  	if (levels > ctx->argc) {
  		mandoc_msg(MANDOCERR_SHIFT,
! 		    ln, argpos, "%d, but max is %d", levels, ctx->argc);
  		levels = ctx->argc;
+ 	}
+ 	if (levels < 0) {
+ 		mandoc_msg(MANDOCERR_ARG_NEG, ln, argpos, "shift %d", levels);
+ 		levels = 0;
  	}
  	if (levels == 0)
  		return ROFF_IGN;