===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/mandoc/tbl_data.c,v
retrieving revision 1.9
retrieving revision 1.10
diff -c -r1.9 -r1.10
*** src/usr.bin/mandoc/tbl_data.c	2011/02/10 00:06:30	1.9
--- src/usr.bin/mandoc/tbl_data.c	2011/04/21 22:59:54	1.10
***************
*** 1,4 ****
! /*	$Id: tbl_data.c,v 1.9 2011/02/10 00:06:30 schwarze Exp $ */
  /*
   * Copyright (c) 2009, 2010, 2011 Kristaps Dzonsons <kristaps@bsd.lv>
   * Copyright (c) 2011 Ingo Schwarze <schwarze@openbsd.org>
--- 1,4 ----
! /*	$Id: tbl_data.c,v 1.10 2011/04/21 22:59:54 schwarze Exp $ */
  /*
   * Copyright (c) 2009, 2010, 2011 Kristaps Dzonsons <kristaps@bsd.lv>
   * Copyright (c) 2011 Ingo Schwarze <schwarze@openbsd.org>
***************
*** 102,109 ****
  		return(0);
  	}
  
! 	dat->string = mandoc_malloc(*pos - sv + 1);
! 	memcpy(dat->string, &p[sv], *pos - sv);
  	dat->string[*pos - sv] = '\0';
  
  	if (p[*pos])
--- 102,111 ----
  		return(0);
  	}
  
! 	assert(*pos - sv >= 0);
! 
! 	dat->string = mandoc_malloc((size_t)(*pos - sv + 1));
! 	memcpy(dat->string, &p[sv], (size_t)(*pos - sv));
  	dat->string[*pos - sv] = '\0';
  
  	if (p[*pos])