===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/mandoc/roff_escape.c,v
retrieving revision 1.9
retrieving revision 1.10
diff -c -r1.9 -r1.10
*** src/usr.bin/mandoc/roff_escape.c	2022/06/05 10:19:47	1.9
--- src/usr.bin/mandoc/roff_escape.c	2022/06/05 13:42:49	1.10
***************
*** 1,4 ****
! /* $OpenBSD: roff_escape.c,v 1.9 2022/06/05 10:19:47 schwarze Exp $ */
  /*
   * Copyright (c) 2011, 2012, 2013, 2014, 2015, 2017, 2018, 2020, 2022
   *               Ingo Schwarze <schwarze@openbsd.org>
--- 1,4 ----
! /* $OpenBSD: roff_escape.c,v 1.10 2022/06/05 13:42:49 schwarze Exp $ */
  /*
   * Copyright (c) 2011, 2012, 2013, 2014, 2015, 2017, 2018, 2020, 2022
   *               Ingo Schwarze <schwarze@openbsd.org>
***************
*** 310,322 ****
  	iendarg = iarg;
  	while (maxl > 0) {
  		if (buf[iendarg] == '\0') {
  			/* Ignore an incomplete argument except for \w. */
  			if (buf[inam] != 'w')
  				iendarg = iarg;
- 			if (rval == ESCAPE_EXPAND)
- 				err = MANDOCERR_ESC_BAD;
- 			else
- 				rval = ESCAPE_ERROR;
  			break;
  		}
  		if (buf[iendarg] == term) {
--- 310,321 ----
  	iendarg = iarg;
  	while (maxl > 0) {
  		if (buf[iendarg] == '\0') {
+ 			err = MANDOCERR_ESC_INCOMPLETE;
+ 			if (rval != ESCAPE_EXPAND)
+ 				rval = ESCAPE_ERROR;
  			/* Ignore an incomplete argument except for \w. */
  			if (buf[inam] != 'w')
  				iendarg = iarg;
  			break;
  		}
  		if (buf[iendarg] == term) {
***************
*** 401,406 ****
--- 400,406 ----
  		 */
  
  		if (term != '\0' && argl == 1 && buf[iarg] != '-') {
+ 			err = MANDOCERR_ESC_BADCHAR;
  			rval = ESCAPE_ERROR;
  			break;
  		}
***************
*** 416,423 ****
  			c = 0;
  			for (i = iarg; i < iendarg; i++)
  				c = 10 * c + (buf[i] - '0');
! 			if (c < 0x21 || (c > 0x7e && c < 0xa0) || c > 0xff)
  				break;
  			iarg += 4;
  			rval = ESCAPE_NUMBERED;
  			break;
--- 416,425 ----
  			c = 0;
  			for (i = iarg; i < iendarg; i++)
  				c = 10 * c + (buf[i] - '0');
! 			if (c < 0x21 || (c > 0x7e && c < 0xa0) || c > 0xff) {
! 				err = MANDOCERR_ESC_BADCHAR;
  				break;
+ 			}
  			iarg += 4;
  			rval = ESCAPE_NUMBERED;
  			break;
***************
*** 433,445 ****
  		if (buf[iarg] != 'u' || argl < 5 || argl > 7)
  			break;
  		if (argl == 7 &&
! 		    (buf[iarg + 1] != '1' || buf[iarg + 2] != '0'))
  			break;
! 		if (argl == 6 && buf[iarg + 1] == '0')
  			break;
  		if (argl == 5 && buf[iarg + 1] == 'D' &&
! 		    strchr("89ABCDEF", buf[iarg + 2]) != NULL)
  			break;
  		if ((int)strspn(buf + iarg + 1, "0123456789ABCDEFabcdef")
  		    + 1 == argl)
  			rval = ESCAPE_UNICODE;
--- 435,453 ----
  		if (buf[iarg] != 'u' || argl < 5 || argl > 7)
  			break;
  		if (argl == 7 &&
! 		    (buf[iarg + 1] != '1' || buf[iarg + 2] != '0')) {
! 			err = MANDOCERR_ESC_BADCHAR;
  			break;
! 		}
! 		if (argl == 6 && buf[iarg + 1] == '0') {
! 			err = MANDOCERR_ESC_BADCHAR;
  			break;
+ 		}
  		if (argl == 5 && buf[iarg + 1] == 'D' &&
! 		    strchr("89ABCDEF", buf[iarg + 2]) != NULL) {
! 			err = MANDOCERR_ESC_BADCHAR;
  			break;
+ 		}
  		if ((int)strspn(buf + iarg + 1, "0123456789ABCDEFabcdef")
  		    + 1 == argl)
  			rval = ESCAPE_UNICODE;
***************
*** 477,483 ****
  	*resc = iesc;
  	switch (rval) {
  	case ESCAPE_ERROR:
! 		err = MANDOCERR_ESC_BAD;
  		break;
  	case ESCAPE_UNSUPP:
  		err = MANDOCERR_ESC_UNSUPP;
--- 485,492 ----
  	*resc = iesc;
  	switch (rval) {
  	case ESCAPE_ERROR:
! 		if (err == MANDOCERR_OK)
! 			err = MANDOCERR_ESC_BAD;
  		break;
  	case ESCAPE_UNSUPP:
  		err = MANDOCERR_ESC_UNSUPP;
***************
*** 487,494 ****
  			err = MANDOCERR_ESC_UNDEF;
  		break;
  	case ESCAPE_SPECIAL:
! 		if (mchars_spec2cp(buf + iarg, argl) < 0)
! 			err = MANDOCERR_ESC_BAD;
  		break;
  	default:
  		break;
--- 496,505 ----
  			err = MANDOCERR_ESC_UNDEF;
  		break;
  	case ESCAPE_SPECIAL:
! 		if (mchars_spec2cp(buf + iarg, argl) >= 0)
! 			err = MANDOCERR_OK;
! 		else if (err == MANDOCERR_OK)
! 			err = MANDOCERR_ESC_UNKCHAR;
  		break;
  	default:
  		break;