external/bsd/mdocml/dist/roff.c

   1 /*      Id: roff.c,v 1.189 2013/12/30 18:44:06 schwarze Exp  */
   2 /*
   3  * Copyright (c) 2010, 2011, 2012 Kristaps Dzonsons <kristaps@bsd.lv>
   4  * Copyright (c) 2010, 2011, 2012, 2013 Ingo Schwarze <schwarze@openbsd.org>
   5  *
   6  * Permission to use, copy, modify, and distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHORS DISCLAIM ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18 #ifdef HAVE_CONFIG_H
  19 #include "config.h"
  20 #endif
  21
  22 #include <assert.h>
  23 #include <ctype.h>
  24 #include <stdio.h>
  25 #include <stdlib.h>
  26 #include <string.h>
  27
  28 #include "mandoc.h"
  29 #include "libroff.h"
  30 #include "libmandoc.h"
  31
  32 /* Maximum number of nested if-else conditionals. */
  33 #define RSTACK_MAX      128
  34
  35 /* Maximum number of string expansions per line, to break infinite loops. */
  36 #define EXPAND_LIMIT    1000
  37
  38 enum    rofft {
  39         ROFF_ad,
  40         ROFF_am,
  41         ROFF_ami,
  42         ROFF_am1,
  43         ROFF_cc,
  44         ROFF_de,
  45         ROFF_dei,
  46         ROFF_de1,
  47         ROFF_ds,
  48         ROFF_el,
  49         ROFF_fam,
  50         ROFF_hw,
  51         ROFF_hy,
  52         ROFF_ie,
  53         ROFF_if,
  54         ROFF_ig,
  55         ROFF_it,
  56         ROFF_ne,
  57         ROFF_nh,
  58         ROFF_nr,
  59         ROFF_ns,
  60         ROFF_ps,
  61         ROFF_rm,
  62         ROFF_so,
  63         ROFF_ta,
  64         ROFF_tr,
  65         ROFF_Dd,
  66         ROFF_TH,
  67         ROFF_TS,
  68         ROFF_TE,
  69         ROFF_T_,
  70         ROFF_EQ,
  71         ROFF_EN,
  72         ROFF_cblock,
  73         ROFF_ccond,
  74         ROFF_USERDEF,
  75         ROFF_MAX
  76 };
  77
  78 enum    roffrule {
  79         ROFFRULE_DENY,
  80         ROFFRULE_ALLOW
  81 };
  82
  83 /*
  84  * An incredibly-simple string buffer.
  85  */
  86 struct  roffstr {
  87         char            *p; /* nil-terminated buffer */
  88         size_t           sz; /* saved strlen(p) */
  89 };
  90
  91 /*
  92  * A key-value roffstr pair as part of a singly-linked list.
  93  */
  94 struct  roffkv {
  95         struct roffstr   key;
  96         struct roffstr   val;
  97         struct roffkv   *next; /* next in list */
  98 };
  99
 100 /*
 101  * A single number register as part of a singly-linked list.
 102  */
 103 struct  roffreg {
 104         struct roffstr   key;
 105         int              val;
 106         struct roffreg  *next;
 107 };
 108
 109 struct  roff {
 110         enum mparset     parsetype; /* requested parse type */
 111         struct mparse   *parse; /* parse point */
 112         struct roffnode *last; /* leaf of stack */
 113         enum roffrule    rstack[RSTACK_MAX]; /* stack of !`ie' rules */
 114         char             control; /* control character */
 115         int              rstackpos; /* position in rstack */
 116         struct roffreg  *regtab; /* number registers */
 117         struct roffkv   *strtab; /* user-defined strings & macros */
 118         struct roffkv   *xmbtab; /* multi-byte trans table (`tr') */
 119         struct roffstr  *xtab; /* single-byte trans table (`tr') */
 120         const char      *current_string; /* value of last called user macro */
 121         struct tbl_node *first_tbl; /* first table parsed */
 122         struct tbl_node *last_tbl; /* last table parsed */
 123         struct tbl_node *tbl; /* current table being parsed */
 124         struct eqn_node *last_eqn; /* last equation parsed */
 125         struct eqn_node *first_eqn; /* first equation parsed */
 126         struct eqn_node *eqn; /* current equation being parsed */
 127 };
 128
 129 struct  roffnode {
 130         enum rofft       tok; /* type of node */
 131         struct roffnode *parent; /* up one in stack */
 132         int              line; /* parse line */
 133         int              col; /* parse col */
 134         char            *name; /* node name, e.g. macro name */
 135         char            *end; /* end-rules: custom token */
 136         int              endspan; /* end-rules: next-line or infty */
 137         enum roffrule    rule; /* current evaluation rule */
 138 };
 139
 140 #define ROFF_ARGS        struct roff *r, /* parse ctx */ \
 141                          enum rofft tok, /* tok of macro */ \
 142                          char **bufp, /* input buffer */ \
 143                          size_t *szp, /* size of input buffer */ \
 144                          int ln, /* parse line */ \
 145                          int ppos, /* original pos in buffer */ \
 146                          int pos, /* current pos in buffer */ \
 147                          int *offs /* reset offset of buffer data */
 148
 149 typedef enum rofferr (*roffproc)(ROFF_ARGS);
 150
 151 struct  roffmac {
 152         const char      *name; /* macro name */
 153         roffproc         proc; /* process new macro */
 154         roffproc         text; /* process as child text of macro */
 155         roffproc         sub; /* process as child of macro */
 156         int              flags;
 157 #define ROFFMAC_STRUCT  (1 << 0) /* always interpret */
 158         struct roffmac  *next;
 159 };
 160
 161 struct  predef {
 162         const char      *name; /* predefined input name */
 163         const char      *str; /* replacement symbol */
 164 };
 165
 166 #define PREDEF(__name, __str) \
 167         { (__name), (__str) },
 168
 169 static  enum rofft       roffhash_find(const char *, size_t);
 170 static  void             roffhash_init(void);
 171 static  void             roffnode_cleanscope(struct roff *);
 172 static  void             roffnode_pop(struct roff *);
 173 static  void             roffnode_push(struct roff *, enum rofft,
 174                                 const char *, int, int);
 175 static  enum rofferr     roff_block(ROFF_ARGS);
 176 static  enum rofferr     roff_block_text(ROFF_ARGS);
 177 static  enum rofferr     roff_block_sub(ROFF_ARGS);
 178 static  enum rofferr     roff_cblock(ROFF_ARGS);
 179 static  enum rofferr     roff_cc(ROFF_ARGS);
 180 static  enum rofferr     roff_ccond(ROFF_ARGS);
 181 static  enum rofferr     roff_cond(ROFF_ARGS);
 182 static  enum rofferr     roff_cond_text(ROFF_ARGS);
 183 static  enum rofferr     roff_cond_sub(ROFF_ARGS);
 184 static  enum rofferr     roff_ds(ROFF_ARGS);
 185 static  enum roffrule    roff_evalcond(const char *, int *);
 186 static  void             roff_free1(struct roff *);
 187 static  void             roff_freereg(struct roffreg *);
 188 static  void             roff_freestr(struct roffkv *);
 189 static  char            *roff_getname(struct roff *, char **, int, int);
 190 static  int              roff_getnum(const char *, int *, int *);
 191 static  int              roff_getop(const char *, int *, char *);
 192 static  int              roff_getregn(const struct roff *,
 193                                 const char *, size_t);
 194 static  const char      *roff_getstrn(const struct roff *,
 195                                 const char *, size_t);
 196 static  enum rofferr     roff_it(ROFF_ARGS);
 197 static  enum rofferr     roff_line_ignore(ROFF_ARGS);
 198 static  enum rofferr     roff_nr(ROFF_ARGS);
 199 static  void             roff_openeqn(struct roff *, const char *,
 200                                 int, int, const char *);
 201 static  enum rofft       roff_parse(struct roff *, const char *, int *);
 202 static  enum rofferr     roff_parsetext(char **, size_t *, int, int *);
 203 static  enum rofferr     roff_res(struct roff *,
 204                                 char **, size_t *, int, int);
 205 static  enum rofferr     roff_rm(ROFF_ARGS);
 206 static  void             roff_setstr(struct roff *,
 207                                 const char *, const char *, int);
 208 static  void             roff_setstrn(struct roffkv **, const char *,
 209                                 size_t, const char *, size_t, int);
 210 static  enum rofferr     roff_so(ROFF_ARGS);
 211 static  enum rofferr     roff_tr(ROFF_ARGS);
 212 static  enum rofferr     roff_Dd(ROFF_ARGS);
 213 static  enum rofferr     roff_TH(ROFF_ARGS);
 214 static  enum rofferr     roff_TE(ROFF_ARGS);
 215 static  enum rofferr     roff_TS(ROFF_ARGS);
 216 static  enum rofferr     roff_EQ(ROFF_ARGS);
 217 static  enum rofferr     roff_EN(ROFF_ARGS);
 218 static  enum rofferr     roff_T_(ROFF_ARGS);
 219 static  enum rofferr     roff_userdef(ROFF_ARGS);
 220
 221 /* See roffhash_find() */
 222
 223 #define ASCII_HI         126
 224 #define ASCII_LO         33
 225 #define HASHWIDTH       (ASCII_HI - ASCII_LO + 1)
 226
 227 static  struct roffmac  *hash[HASHWIDTH];
 228
 229 static  struct roffmac   roffs[ROFF_MAX] = {
 230         { "ad", roff_line_ignore, NULL, NULL, 0, NULL },
 231         { "am", roff_block, roff_block_text, roff_block_sub, 0, NULL },
 232         { "ami", roff_block, roff_block_text, roff_block_sub, 0, NULL },
 233         { "am1", roff_block, roff_block_text, roff_block_sub, 0, NULL },
 234         { "cc", roff_cc, NULL, NULL, 0, NULL },
 235         { "de", roff_block, roff_block_text, roff_block_sub, 0, NULL },
 236         { "dei", roff_block, roff_block_text, roff_block_sub, 0, NULL },
 237         { "de1", roff_block, roff_block_text, roff_block_sub, 0, NULL },
 238         { "ds", roff_ds, NULL, NULL, 0, NULL },
 239         { "el", roff_cond, roff_cond_text, roff_cond_sub, ROFFMAC_STRUCT, NULL },
 240         { "fam", roff_line_ignore, NULL, NULL, 0, NULL },
 241         { "hw", roff_line_ignore, NULL, NULL, 0, NULL },
 242         { "hy", roff_line_ignore, NULL, NULL, 0, NULL },
 243         { "ie", roff_cond, roff_cond_text, roff_cond_sub, ROFFMAC_STRUCT, NULL },
 244         { "if", roff_cond, roff_cond_text, roff_cond_sub, ROFFMAC_STRUCT, NULL },
 245         { "ig", roff_block, roff_block_text, roff_block_sub, 0, NULL },
 246         { "it", roff_it, NULL, NULL, 0, NULL },
 247         { "ne", roff_line_ignore, NULL, NULL, 0, NULL },
 248         { "nh", roff_line_ignore, NULL, NULL, 0, NULL },
 249         { "nr", roff_nr, NULL, NULL, 0, NULL },
 250         { "ns", roff_line_ignore, NULL, NULL, 0, NULL },
 251         { "ps", roff_line_ignore, NULL, NULL, 0, NULL },
 252         { "rm", roff_rm, NULL, NULL, 0, NULL },
 253         { "so", roff_so, NULL, NULL, 0, NULL },
 254         { "ta", roff_line_ignore, NULL, NULL, 0, NULL },
 255         { "tr", roff_tr, NULL, NULL, 0, NULL },
 256         { "Dd", roff_Dd, NULL, NULL, 0, NULL },
 257         { "TH", roff_TH, NULL, NULL, 0, NULL },
 258         { "TS", roff_TS, NULL, NULL, 0, NULL },
 259         { "TE", roff_TE, NULL, NULL, 0, NULL },
 260         { "T&", roff_T_, NULL, NULL, 0, NULL },
 261         { "EQ", roff_EQ, NULL, NULL, 0, NULL },
 262         { "EN", roff_EN, NULL, NULL, 0, NULL },
 263         { ".", roff_cblock, NULL, NULL, 0, NULL },
 264         { "\\}", roff_ccond, NULL, NULL, 0, NULL },
 265         { NULL, roff_userdef, NULL, NULL, 0, NULL },
 266 };
 267
 268 const   char *const __mdoc_reserved[] = {
 269         "Ac", "Ad", "An", "Ao", "Ap", "Aq", "Ar", "At",
 270         "Bc", "Bd", "Bf", "Bk", "Bl", "Bo", "Bq",
 271         "Brc", "Bro", "Brq", "Bsx", "Bt", "Bx",
 272         "Cd", "Cm", "Db", "Dc", "Dd", "Dl", "Do", "Dq",
 273         "Ds", "Dt", "Dv", "Dx", "D1",
 274         "Ec", "Ed", "Ef", "Ek", "El", "Em", "em",
 275         "En", "Eo", "Eq", "Er", "Es", "Ev", "Ex",
 276         "Fa", "Fc", "Fd", "Fl", "Fn", "Fo", "Fr", "Ft", "Fx",
 277         "Hf", "Ic", "In", "It", "Lb", "Li", "Lk", "Lp", "LP",
 278         "Me", "Ms", "Mt", "Nd", "Nm", "No", "Ns", "Nx",
 279         "Oc", "Oo", "Op", "Os", "Ot", "Ox",
 280         "Pa", "Pc", "Pf", "Po", "Pp", "PP", "pp", "Pq",
 281         "Qc", "Ql", "Qo", "Qq", "Or", "Rd", "Re", "Rs", "Rv",
 282         "Sc", "Sf", "Sh", "SH", "Sm", "So", "Sq",
 283         "Ss", "St", "Sx", "Sy",
 284         "Ta", "Tn", "Ud", "Ux", "Va", "Vt", "Xc", "Xo", "Xr",
 285         "%A", "%B", "%D", "%I", "%J", "%N", "%O",
 286         "%P", "%Q", "%R", "%T", "%U", "%V",
 287         NULL
 288 };
 289
 290 const   char *const __man_reserved[] = {
 291         "AT", "B", "BI", "BR", "BT", "DE", "DS", "DT",
 292         "EE", "EN", "EQ", "EX", "HF", "HP", "I", "IB", "IP", "IR",
 293         "LP", "ME", "MT", "OP", "P", "PD", "PP", "PT",
 294         "R", "RB", "RE", "RI", "RS", "SB", "SH", "SM", "SS", "SY",
 295         "TE", "TH", "TP", "TQ", "TS", "T&", "UC", "UE", "UR", "YS",
 296         NULL
 297 };
 298
 299 /* Array of injected predefined strings. */
 300 #define PREDEFS_MAX      38
 301 static  const struct predef predefs[PREDEFS_MAX] = {
 302 #include "predefs.in"
 303 };
 304
 305 /* See roffhash_find() */
 306 #define ROFF_HASH(p)    (p[0] - ASCII_LO)
 307
 308 static  int      roffit_lines;  /* number of lines to delay */
 309 static  char    *roffit_macro;  /* nil-terminated macro line */
 310
 311 static void
 312 roffhash_init(void)
 313 {
 314         struct roffmac   *n;
 315         int               buc, i;
 316
 317         for (i = 0; i < (int)ROFF_USERDEF; i++) {
 318                 assert(roffs[i].name[0] >= ASCII_LO);
 319                 assert(roffs[i].name[0] <= ASCII_HI);
 320
 321                 buc = ROFF_HASH(roffs[i].name);
 322
 323                 if (NULL != (n = hash[buc])) {
 324                         for ( ; n->next; n = n->next)
 325                                 /* Do nothing. */ ;
 326                         n->next = &roffs[i];
 327                 } else
 328                         hash[buc] = &roffs[i];
 329         }
 330 }
 331
 332 /*
 333  * Look up a roff token by its name.  Returns ROFF_MAX if no macro by
 334  * the nil-terminated string name could be found.
 335  */
 336 static enum rofft
 337 roffhash_find(const char *p, size_t s)
 338 {
 339         int              buc;
 340         struct roffmac  *n;
 341
 342         /*
 343          * libroff has an extremely simple hashtable, for the time
 344          * being, which simply keys on the first character, which must
 345          * be printable, then walks a chain.  It works well enough until
 346          * optimised.
 347          */
 348
 349         if (p[0] < ASCII_LO || p[0] > ASCII_HI)
 350                 return(ROFF_MAX);
 351
 352         buc = ROFF_HASH(p);
 353
 354         if (NULL == (n = hash[buc]))
 355                 return(ROFF_MAX);
 356         for ( ; n; n = n->next)
 357                 if (0 == strncmp(n->name, p, s) && '\0' == n->name[(int)s])
 358                         return((enum rofft)(n - roffs));
 359
 360         return(ROFF_MAX);
 361 }
 362
 363
 364 /*
 365  * Pop the current node off of the stack of roff instructions currently
 366  * pending.
 367  */
 368 static void
 369 roffnode_pop(struct roff *r)
 370 {
 371         struct roffnode *p;
 372
 373         assert(r->last);
 374         p = r->last;
 375
 376         r->last = r->last->parent;
 377         free(p->name);
 378         free(p->end);
 379         free(p);
 380 }
 381
 382
 383 /*
 384  * Push a roff node onto the instruction stack.  This must later be
 385  * removed with roffnode_pop().
 386  */
 387 static void
 388 roffnode_push(struct roff *r, enum rofft tok, const char *name,
 389                 int line, int col)
 390 {
 391         struct roffnode *p;
 392
 393         p = mandoc_calloc(1, sizeof(struct roffnode));
 394         p->tok = tok;
 395         if (name)
 396                 p->name = mandoc_strdup(name);
 397         p->parent = r->last;
 398         p->line = line;
 399         p->col = col;
 400         p->rule = p->parent ? p->parent->rule : ROFFRULE_DENY;
 401
 402         r->last = p;
 403 }
 404
 405
 406 static void
 407 roff_free1(struct roff *r)
 408 {
 409         struct tbl_node *tbl;
 410         struct eqn_node *e;
 411         int              i;
 412
 413         while (NULL != (tbl = r->first_tbl)) {
 414                 r->first_tbl = tbl->next;
 415                 tbl_free(tbl);
 416         }
 417
 418         r->first_tbl = r->last_tbl = r->tbl = NULL;
 419
 420         while (NULL != (e = r->first_eqn)) {
 421                 r->first_eqn = e->next;
 422                 eqn_free(e);
 423         }
 424
 425         r->first_eqn = r->last_eqn = r->eqn = NULL;
 426
 427         while (r->last)
 428                 roffnode_pop(r);
 429
 430         roff_freestr(r->strtab);
 431         roff_freestr(r->xmbtab);
 432
 433         r->strtab = r->xmbtab = NULL;
 434
 435         roff_freereg(r->regtab);
 436
 437         r->regtab = NULL;
 438
 439         if (r->xtab)
 440                 for (i = 0; i < 128; i++)
 441                         free(r->xtab[i].p);
 442
 443         free(r->xtab);
 444         r->xtab = NULL;
 445 }
 446
 447 void
 448 roff_reset(struct roff *r)
 449 {
 450         int              i;
 451
 452         roff_free1(r);
 453
 454         r->control = 0;
 455
 456         for (i = 0; i < PREDEFS_MAX; i++)
 457                 roff_setstr(r, predefs[i].name, predefs[i].str, 0);
 458 }
 459
 460
 461 void
 462 roff_free(struct roff *r)
 463 {
 464
 465         roff_free1(r);
 466         free(r);
 467 }
 468
 469
 470 struct roff *
 471 roff_alloc(enum mparset type, struct mparse *parse)
 472 {
 473         struct roff     *r;
 474         int              i;
 475
 476         r = mandoc_calloc(1, sizeof(struct roff));
 477         r->parsetype = type;
 478         r->parse = parse;
 479         r->rstackpos = -1;
 480
 481         roffhash_init();
 482
 483         for (i = 0; i < PREDEFS_MAX; i++)
 484                 roff_setstr(r, predefs[i].name, predefs[i].str, 0);
 485
 486         return(r);
 487 }
 488
 489 /*
 490  * In the current line, expand user-defined strings ("\*")
 491  * and references to number registers ("\n").
 492  * Also check the syntax of other escape sequences.
 493  */
 494 static enum rofferr
 495 roff_res(struct roff *r, char **bufp, size_t *szp, int ln, int pos)
 496 {
 497         char             ubuf[12]; /* buffer to print the number */
 498         const char      *stesc; /* start of an escape sequence ('\\') */
 499         const char      *stnam; /* start of the name, after "[(*" */
 500         const char      *cp;    /* end of the name, e.g. before ']' */
 501         const char      *res;   /* the string to be substituted */
 502         char            *nbuf;  /* new buffer to copy bufp to */
 503         size_t           nsz;   /* size of the new buffer */
 504         size_t           maxl;  /* expected length of the escape name */
 505         size_t           naml;  /* actual length of the escape name */
 506         int              expand_count;  /* to avoid infinite loops */
 507
 508         expand_count = 0;
 509
 510 again:
 511         cp = *bufp + pos;
 512         while (NULL != (cp = strchr(cp, '\\'))) {
 513                 stesc = cp++;
 514
 515                 /*
 516                  * The second character must be an asterisk or an n.
 517                  * If it isn't, skip it anyway:  It is escaped,
 518                  * so it can't start another escape sequence.
 519                  */
 520
 521                 if ('\0' == *cp)
 522                         return(ROFF_CONT);
 523
 524                 switch (*cp) {
 525                 case ('*'):
 526                         res = NULL;
 527                         break;
 528                 case ('n'):
 529                         res = ubuf;
 530                         break;
 531                 default:
 532                         if (ESCAPE_ERROR != mandoc_escape(&cp, NULL, NULL))
 533                                 continue;
 534                         mandoc_msg
 535                                 (MANDOCERR_BADESCAPE, r->parse,
 536                                  ln, (int)(stesc - *bufp), NULL);
 537                         return(ROFF_CONT);
 538                 }
 539
 540                 cp++;
 541
 542                 /*
 543                  * The third character decides the length
 544                  * of the name of the string or register.
 545                  * Save a pointer to the name.
 546                  */
 547
 548                 switch (*cp) {
 549                 case ('\0'):
 550                         return(ROFF_CONT);
 551                 case ('('):
 552                         cp++;
 553                         maxl = 2;
 554                         break;
 555                 case ('['):
 556                         cp++;
 557                         maxl = 0;
 558                         break;
 559                 default:
 560                         maxl = 1;
 561                         break;
 562                 }
 563                 stnam = cp;
 564
 565                 /* Advance to the end of the name. */
 566
 567                 for (naml = 0; 0 == maxl || naml < maxl; naml++, cp++) {
 568                         if ('\0' == *cp) {
 569                                 mandoc_msg
 570                                         (MANDOCERR_BADESCAPE,
 571                                          r->parse, ln,
 572                                          (int)(stesc - *bufp), NULL);
 573                                 return(ROFF_CONT);
 574                         }
 575                         if (0 == maxl && ']' == *cp)
 576                                 break;
 577                 }
 578
 579                 /*
 580                  * Retrieve the replacement string; if it is
 581                  * undefined, resume searching for escapes.
 582                  */
 583
 584                 if (NULL == res)
 585                         res = roff_getstrn(r, stnam, naml);
 586                 else
 587                         snprintf(ubuf, sizeof(ubuf), "%d",
 588                             roff_getregn(r, stnam, naml));
 589
 590                 if (NULL == res) {
 591                         mandoc_msg
 592                                 (MANDOCERR_BADESCAPE, r->parse,
 593                                  ln, (int)(stesc - *bufp), NULL);
 594                         res = "";
 595                 }
 596
 597                 /* Replace the escape sequence by the string. */
 598
 599                 pos = stesc - *bufp;
 600
 601                 nsz = *szp + strlen(res) + 1;
 602                 nbuf = mandoc_malloc(nsz);
 603
 604                 strlcpy(nbuf, *bufp, (size_t)(stesc - *bufp + 1));
 605                 strlcat(nbuf, res, nsz);
 606                 strlcat(nbuf, cp + (maxl ? 0 : 1), nsz);
 607
 608                 free(*bufp);
 609
 610                 *bufp = nbuf;
 611                 *szp = nsz;
 612
 613                 if (EXPAND_LIMIT >= ++expand_count)
 614                         goto again;
 615
 616                 /* Just leave the string unexpanded. */
 617                 mandoc_msg(MANDOCERR_ROFFLOOP, r->parse, ln, pos, NULL);
 618                 return(ROFF_IGN);
 619         }
 620         return(ROFF_CONT);
 621 }
 622
 623 /*
 624  * Process text streams:
 625  * Convert all breakable hyphens into ASCII_HYPH.
 626  * Decrement and spring input line trap.
 627  */
 628 static enum rofferr
 629 roff_parsetext(char **bufp, size_t *szp, int pos, int *offs)
 630 {
 631         size_t           sz;
 632         const char      *start;
 633         char            *p;
 634         int              isz;
 635         enum mandoc_esc  esc;
 636
 637         start = p = *bufp + pos;
 638
 639         while ('\0' != *p) {
 640                 sz = strcspn(p, "-\\");
 641                 p += sz;
 642
 643                 if ('\0' == *p)
 644                         break;
 645
 646                 if ('\\' == *p) {
 647                         /* Skip over escapes. */
 648                         p++;
 649                         esc = mandoc_escape((const char **)(void *)&p, NULL, NULL);
 650                         if (ESCAPE_ERROR == esc)
 651                                 break;
 652                         continue;
 653                 } else if (p == start) {
 654                         p++;
 655                         continue;
 656                 }
 657
 658                 if (isalpha((unsigned char)p[-1]) &&
 659                     isalpha((unsigned char)p[1]))
 660                         *p = ASCII_HYPH;
 661                 p++;
 662         }
 663
 664         /* Spring the input line trap. */
 665         if (1 == roffit_lines) {
 666                 isz = asprintf(&p, "%s\n.%s", *bufp, roffit_macro);
 667                 if (-1 == isz) {
 668                         perror(NULL);
 669                         exit((int)MANDOCLEVEL_SYSERR);
 670                 }
 671                 free(*bufp);
 672                 *bufp = p;
 673                 *szp = isz + 1;
 674                 *offs = 0;
 675                 free(roffit_macro);
 676                 roffit_lines = 0;
 677                 return(ROFF_REPARSE);
 678         } else if (1 < roffit_lines)
 679                 --roffit_lines;
 680         return(ROFF_CONT);
 681 }
 682
 683 enum rofferr
 684 roff_parseln(struct roff *r, int ln, char **bufp,
 685                 size_t *szp, int pos, int *offs)
 686 {
 687         enum rofft       t;
 688         enum rofferr     e;
 689         int              ppos, ctl;
 690
 691         /*
 692          * Run the reserved-word filter only if we have some reserved
 693          * words to fill in.
 694          */
 695
 696         e = roff_res(r, bufp, szp, ln, pos);
 697         if (ROFF_IGN == e)
 698                 return(e);
 699         assert(ROFF_CONT == e);
 700
 701         ppos = pos;
 702         ctl = roff_getcontrol(r, *bufp, &pos);
 703
 704         /*
 705          * First, if a scope is open and we're not a macro, pass the
 706          * text through the macro's filter.  If a scope isn't open and
 707          * we're not a macro, just let it through.
 708          * Finally, if there's an equation scope open, divert it into it
 709          * no matter our state.
 710          */
 711
 712         if (r->last && ! ctl) {
 713                 t = r->last->tok;
 714                 assert(roffs[t].text);
 715                 e = (*roffs[t].text)
 716                         (r, t, bufp, szp, ln, pos, pos, offs);
 717                 assert(ROFF_IGN == e || ROFF_CONT == e);
 718                 if (ROFF_CONT != e)
 719                         return(e);
 720         }
 721         if (r->eqn)
 722                 return(eqn_read(&r->eqn, ln, *bufp, ppos, offs));
 723         if ( ! ctl) {
 724                 if (r->tbl)
 725                         return(tbl_read(r->tbl, ln, *bufp, pos));
 726                 return(roff_parsetext(bufp, szp, pos, offs));
 727         }
 728
 729         /*
 730          * If a scope is open, go to the child handler for that macro,
 731          * as it may want to preprocess before doing anything with it.
 732          * Don't do so if an equation is open.
 733          */
 734
 735         if (r->last) {
 736                 t = r->last->tok;
 737                 assert(roffs[t].sub);
 738                 return((*roffs[t].sub)
 739                                 (r, t, bufp, szp,
 740                                  ln, ppos, pos, offs));
 741         }
 742
 743         /*
 744          * Lastly, as we've no scope open, try to look up and execute
 745          * the new macro.  If no macro is found, simply return and let
 746          * the compilers handle it.
 747          */
 748
 749         if (ROFF_MAX == (t = roff_parse(r, *bufp, &pos)))
 750                 return(ROFF_CONT);
 751
 752         assert(roffs[t].proc);
 753         return((*roffs[t].proc)
 754                         (r, t, bufp, szp,
 755                          ln, ppos, pos, offs));
 756 }
 757
 758
 759 void
 760 roff_endparse(struct roff *r)
 761 {
 762
 763         if (r->last)
 764                 mandoc_msg(MANDOCERR_SCOPEEXIT, r->parse,
 765                                 r->last->line, r->last->col, NULL);
 766
 767         if (r->eqn) {
 768                 mandoc_msg(MANDOCERR_SCOPEEXIT, r->parse,
 769                                 r->eqn->eqn.ln, r->eqn->eqn.pos, NULL);
 770                 eqn_end(&r->eqn);
 771         }
 772
 773         if (r->tbl) {
 774                 mandoc_msg(MANDOCERR_SCOPEEXIT, r->parse,
 775                                 r->tbl->line, r->tbl->pos, NULL);
 776                 tbl_end(&r->tbl);
 777         }
 778 }
 779
 780 /*
 781  * Parse a roff node's type from the input buffer.  This must be in the
 782  * form of ".foo xxx" in the usual way.
 783  */
 784 static enum rofft
 785 roff_parse(struct roff *r, const char *buf, int *pos)
 786 {
 787         const char      *mac;
 788         size_t           maclen;
 789         enum rofft       t;
 790
 791         if ('\0' == buf[*pos] || '"' == buf[*pos] ||
 792                         '\t' == buf[*pos] || ' ' == buf[*pos])
 793                 return(ROFF_MAX);
 794
 795         /*
 796          * We stop the macro parse at an escape, tab, space, or nil.
 797          * However, `\}' is also a valid macro, so make sure we don't
 798          * clobber it by seeing the `\' as the end of token.
 799          */
 800
 801         mac = buf + *pos;
 802         maclen = strcspn(mac + 1, " \\\t\0") + 1;
 803
 804         t = (r->current_string = roff_getstrn(r, mac, maclen))
 805             ? ROFF_USERDEF : roffhash_find(mac, maclen);
 806
 807         *pos += (int)maclen;
 808
 809         while (buf[*pos] && ' ' == buf[*pos])
 810                 (*pos)++;
 811
 812         return(t);
 813 }
 814
 815 /* ARGSUSED */
 816 static enum rofferr
 817 roff_cblock(ROFF_ARGS)
 818 {
 819
 820         /*
 821          * A block-close `..' should only be invoked as a child of an
 822          * ignore macro, otherwise raise a warning and just ignore it.
 823          */
 824
 825         if (NULL == r->last) {
 826                 mandoc_msg(MANDOCERR_NOSCOPE, r->parse, ln, ppos, NULL);
 827                 return(ROFF_IGN);
 828         }
 829
 830         switch (r->last->tok) {
 831         case (ROFF_am):
 832                 /* FALLTHROUGH */
 833         case (ROFF_ami):
 834                 /* FALLTHROUGH */
 835         case (ROFF_am1):
 836                 /* FALLTHROUGH */
 837         case (ROFF_de):
 838                 /* ROFF_de1 is remapped to ROFF_de in roff_block(). */
 839                 /* FALLTHROUGH */
 840         case (ROFF_dei):
 841                 /* FALLTHROUGH */
 842         case (ROFF_ig):
 843                 break;
 844         default:
 845                 mandoc_msg(MANDOCERR_NOSCOPE, r->parse, ln, ppos, NULL);
 846                 return(ROFF_IGN);
 847         }
 848
 849         if ((*bufp)[pos])
 850                 mandoc_msg(MANDOCERR_ARGSLOST, r->parse, ln, pos, NULL);
 851
 852         roffnode_pop(r);
 853         roffnode_cleanscope(r);
 854         return(ROFF_IGN);
 855
 856 }
 857
 858
 859 static void
 860 roffnode_cleanscope(struct roff *r)
 861 {
 862
 863         while (r->last) {
 864                 if (--r->last->endspan != 0)
 865                         break;
 866                 roffnode_pop(r);
 867         }
 868 }
 869
 870
 871 /* ARGSUSED */
 872 static enum rofferr
 873 roff_ccond(ROFF_ARGS)
 874 {
 875
 876         if (NULL == r->last) {
 877                 mandoc_msg(MANDOCERR_NOSCOPE, r->parse, ln, ppos, NULL);
 878                 return(ROFF_IGN);
 879         }
 880
 881         switch (r->last->tok) {
 882         case (ROFF_el):
 883                 /* FALLTHROUGH */
 884         case (ROFF_ie):
 885                 /* FALLTHROUGH */
 886         case (ROFF_if):
 887                 break;
 888         default:
 889                 mandoc_msg(MANDOCERR_NOSCOPE, r->parse, ln, ppos, NULL);
 890                 return(ROFF_IGN);
 891         }
 892
 893         if (r->last->endspan > -1) {
 894                 mandoc_msg(MANDOCERR_NOSCOPE, r->parse, ln, ppos, NULL);
 895                 return(ROFF_IGN);
 896         }
 897
 898         if ((*bufp)[pos])
 899                 mandoc_msg(MANDOCERR_ARGSLOST, r->parse, ln, pos, NULL);
 900
 901         roffnode_pop(r);
 902         roffnode_cleanscope(r);
 903         return(ROFF_IGN);
 904 }
 905
 906
 907 /* ARGSUSED */
 908 static enum rofferr
 909 roff_block(ROFF_ARGS)
 910 {
 911         int             sv;
 912         size_t          sz;
 913         char            *name;
 914
 915         name = NULL;
 916
 917         if (ROFF_ig != tok) {
 918                 if ('\0' == (*bufp)[pos]) {
 919                         mandoc_msg(MANDOCERR_NOARGS, r->parse, ln, ppos, NULL);
 920                         return(ROFF_IGN);
 921                 }
 922
 923                 /*
 924                  * Re-write `de1', since we don't really care about
 925                  * groff's strange compatibility mode, into `de'.
 926                  */
 927
 928                 if (ROFF_de1 == tok)
 929                         tok = ROFF_de;
 930                 if (ROFF_de == tok)
 931                         name = *bufp + pos;
 932                 else
 933                         mandoc_msg(MANDOCERR_REQUEST, r->parse, ln, ppos,
 934                             roffs[tok].name);
 935
 936                 while ((*bufp)[pos] && ! isspace((unsigned char)(*bufp)[pos]))
 937                         pos++;
 938
 939                 while (isspace((unsigned char)(*bufp)[pos]))
 940                         (*bufp)[pos++] = '\0';
 941         }
 942
 943         roffnode_push(r, tok, name, ln, ppos);
 944
 945         /*
 946          * At the beginning of a `de' macro, clear the existing string
 947          * with the same name, if there is one.  New content will be
 948          * added from roff_block_text() in multiline mode.
 949          */
 950
 951         if (ROFF_de == tok)
 952                 roff_setstr(r, name, "", 0);
 953
 954         if ('\0' == (*bufp)[pos])
 955                 return(ROFF_IGN);
 956
 957         /* If present, process the custom end-of-line marker. */
 958
 959         sv = pos;
 960         while ((*bufp)[pos] && ! isspace((unsigned char)(*bufp)[pos]))
 961                 pos++;
 962
 963         /*
 964          * Note: groff does NOT like escape characters in the input.
 965          * Instead of detecting this, we're just going to let it fly and
 966          * to hell with it.
 967          */
 968
 969         assert(pos > sv);
 970         sz = (size_t)(pos - sv);
 971
 972         if (1 == sz && '.' == (*bufp)[sv])
 973                 return(ROFF_IGN);
 974
 975         r->last->end = mandoc_malloc(sz + 1);
 976
 977         memcpy(r->last->end, *bufp + sv, sz);
 978         r->last->end[(int)sz] = '\0';
 979
 980         if ((*bufp)[pos])
 981                 mandoc_msg(MANDOCERR_ARGSLOST, r->parse, ln, pos, NULL);
 982
 983         return(ROFF_IGN);
 984 }
 985
 986
 987 /* ARGSUSED */
 988 static enum rofferr
 989 roff_block_sub(ROFF_ARGS)
 990 {
 991         enum rofft      t;
 992         int             i, j;
 993
 994         /*
 995          * First check whether a custom macro exists at this level.  If
 996          * it does, then check against it.  This is some of groff's
 997          * stranger behaviours.  If we encountered a custom end-scope
 998          * tag and that tag also happens to be a "real" macro, then we
 999          * need to try interpreting it again as a real macro.  If it's
1000          * not, then return ignore.  Else continue.
1001          */
1002
1003         if (r->last->end) {
1004                 for (i = pos, j = 0; r->last->end[j]; j++, i++)
1005                         if ((*bufp)[i] != r->last->end[j])
1006                                 break;
1007
1008                 if ('\0' == r->last->end[j] &&
1009                                 ('\0' == (*bufp)[i] ||
1010                                  ' ' == (*bufp)[i] ||
1011                                  '\t' == (*bufp)[i])) {
1012                         roffnode_pop(r);
1013                         roffnode_cleanscope(r);
1014
1015                         while (' ' == (*bufp)[i] || '\t' == (*bufp)[i])
1016                                 i++;
1017
1018                         pos = i;
1019                         if (ROFF_MAX != roff_parse(r, *bufp, &pos))
1020                                 return(ROFF_RERUN);
1021                         return(ROFF_IGN);
1022                 }
1023         }
1024
1025         /*
1026          * If we have no custom end-query or lookup failed, then try
1027          * pulling it out of the hashtable.
1028          */
1029
1030         t = roff_parse(r, *bufp, &pos);
1031
1032         /*
1033          * Macros other than block-end are only significant
1034          * in `de' blocks; elsewhere, simply throw them away.
1035          */
1036         if (ROFF_cblock != t) {
1037                 if (ROFF_de == tok)
1038                         roff_setstr(r, r->last->name, *bufp + ppos, 1);
1039                 return(ROFF_IGN);
1040         }
1041
1042         assert(roffs[t].proc);
1043         return((*roffs[t].proc)(r, t, bufp, szp,
1044                                 ln, ppos, pos, offs));
1045 }
1046
1047
1048 /* ARGSUSED */
1049 static enum rofferr
1050 roff_block_text(ROFF_ARGS)
1051 {
1052
1053         if (ROFF_de == tok)
1054                 roff_setstr(r, r->last->name, *bufp + pos, 1);
1055
1056         return(ROFF_IGN);
1057 }
1058
1059
1060 /* ARGSUSED */
1061 static enum rofferr
1062 roff_cond_sub(ROFF_ARGS)
1063 {
1064         enum rofft       t;
1065         enum roffrule    rr;
1066         char            *ep;
1067
1068         rr = r->last->rule;
1069         roffnode_cleanscope(r);
1070         t = roff_parse(r, *bufp, &pos);
1071
1072         /*
1073          * Fully handle known macros when they are structurally
1074          * required or when the conditional evaluated to true.
1075          */
1076
1077         if ((ROFF_MAX != t) &&
1078             (ROFF_ccond == t || ROFFRULE_ALLOW == rr ||
1079              ROFFMAC_STRUCT & roffs[t].flags)) {
1080                 assert(roffs[t].proc);
1081                 return((*roffs[t].proc)(r, t, bufp, szp,
1082                                         ln, ppos, pos, offs));
1083         }
1084
1085         /* Always check for the closing delimiter `\}'. */
1086
1087         ep = &(*bufp)[pos];
1088         while (NULL != (ep = strchr(ep, '\\'))) {
1089                 if ('}' != *(++ep))
1090                         continue;
1091
1092                 /*
1093                  * If we're at the end of line, then just chop
1094                  * off the \} and resize the buffer.
1095                  * If we aren't, then convert it to spaces.
1096                  */
1097
1098                 if ('\0' == *(ep + 1)) {
1099                         *--ep = '\0';
1100                         *szp -= 2;
1101                 } else
1102                         *(ep - 1) = *ep = ' ';
1103
1104                 roff_ccond(r, ROFF_ccond, bufp, szp,
1105                                 ln, pos, pos + 2, offs);
1106                 break;
1107         }
1108         return(ROFFRULE_DENY == rr ? ROFF_IGN : ROFF_CONT);
1109 }
1110
1111 /* ARGSUSED */
1112 static enum rofferr
1113 roff_cond_text(ROFF_ARGS)
1114 {
1115         char            *ep;
1116         enum roffrule    rr;
1117
1118         rr = r->last->rule;
1119         roffnode_cleanscope(r);
1120
1121         ep = &(*bufp)[pos];
1122         for ( ; NULL != (ep = strchr(ep, '\\')); ep++) {
1123                 ep++;
1124                 if ('}' != *ep)
1125                         continue;
1126                 *ep = '&';
1127                 roff_ccond(r, ROFF_ccond, bufp, szp,
1128                                 ln, pos, pos + 2, offs);
1129         }
1130         return(ROFFRULE_DENY == rr ? ROFF_IGN : ROFF_CONT);
1131 }
1132
1133 static int
1134 roff_getnum(const char *v, int *pos, int *res)
1135 {
1136         int p, n;
1137
1138         p = *pos;
1139         n = v[p] == '-';
1140         if (n)
1141                 p++;
1142
1143         for (*res = 0; isdigit((unsigned char)v[p]); p++)
1144                 *res += 10 * *res + v[p] - '0';
1145         if (p == *pos + n)
1146                 return 0;
1147
1148         if (n)
1149                 *res = -*res;
1150
1151         *pos = p;
1152         return 1;
1153 }
1154
1155 static int
1156 roff_getop(const char *v, int *pos, char *res)
1157 {
1158         int e;
1159
1160         *res = v[*pos];
1161         e = v[*pos + 1] == '=';
1162
1163         switch (*res) {
1164         case '=':
1165                 break;
1166         case '>':
1167                 if (e)
1168                         *res = 'g';
1169                 break;
1170         case '<':
1171                 if (e)
1172                         *res = 'l';
1173                 break;
1174         default:
1175                 return(0);
1176         }
1177
1178         *pos += 1 + e;
1179
1180         return(*res);
1181 }
1182
1183 static enum roffrule
1184 roff_evalcond(const char *v, int *pos)
1185 {
1186         int      not, lh, rh;
1187         char     op;
1188
1189         switch (v[*pos]) {
1190         case ('n'):
1191                 (*pos)++;
1192                 return(ROFFRULE_ALLOW);
1193         case ('e'):
1194                 /* FALLTHROUGH */
1195         case ('o'):
1196                 /* FALLTHROUGH */
1197         case ('t'):
1198                 (*pos)++;
1199                 return(ROFFRULE_DENY);
1200         case ('!'):
1201                 (*pos)++;
1202                 not = 1;
1203                 break;
1204         default:
1205                 not = 0;
1206                 break;
1207         }
1208
1209         if (!roff_getnum(v, pos, &lh))
1210                 return ROFFRULE_DENY;
1211         if (!roff_getop(v, pos, &op)) {
1212                 if (lh < 0)
1213                         lh = 0;
1214                 goto out;
1215         }
1216         if (!roff_getnum(v, pos, &rh))
1217                 return ROFFRULE_DENY;
1218         switch (op) {
1219         case 'g':
1220                 lh = lh >= rh;
1221                 break;
1222         case 'l':
1223                 lh = lh <= rh;
1224                 break;
1225         case '=':
1226                 lh = lh == rh;
1227                 break;
1228         case '>':
1229                 lh = lh > rh;
1230                 break;
1231         case '<':
1232                 lh = lh < rh;
1233                 break;
1234         default:
1235                 return ROFFRULE_DENY;
1236         }
1237 out:
1238         if (not)
1239                 lh = !lh;
1240         return lh ? ROFFRULE_ALLOW : ROFFRULE_DENY;
1241 }
1242
1243 /* ARGSUSED */
1244 static enum rofferr
1245 roff_line_ignore(ROFF_ARGS)
1246 {
1247
1248         return(ROFF_IGN);
1249 }
1250
1251 /* ARGSUSED */
1252 static enum rofferr
1253 roff_cond(ROFF_ARGS)
1254 {
1255
1256         roffnode_push(r, tok, NULL, ln, ppos);
1257
1258         /*
1259          * An `.el' has no conditional body: it will consume the value
1260          * of the current rstack entry set in prior `ie' calls or
1261          * defaults to DENY.
1262          *
1263          * If we're not an `el', however, then evaluate the conditional.
1264          */
1265
1266         r->last->rule = ROFF_el == tok ?
1267                 (r->rstackpos < 0 ?
1268                  ROFFRULE_DENY : r->rstack[r->rstackpos--]) :
1269                 roff_evalcond(*bufp, &pos);
1270
1271         /*
1272          * An if-else will put the NEGATION of the current evaluated
1273          * conditional into the stack of rules.
1274          */
1275
1276         if (ROFF_ie == tok) {
1277                 if (r->rstackpos == RSTACK_MAX - 1) {
1278                         mandoc_msg(MANDOCERR_MEM,
1279                                 r->parse, ln, ppos, NULL);
1280                         return(ROFF_ERR);
1281                 }
1282                 r->rstack[++r->rstackpos] =
1283                         ROFFRULE_DENY == r->last->rule ?
1284                         ROFFRULE_ALLOW : ROFFRULE_DENY;
1285         }
1286
1287         /* If the parent has false as its rule, then so do we. */
1288
1289         if (r->last->parent && ROFFRULE_DENY == r->last->parent->rule)
1290                 r->last->rule = ROFFRULE_DENY;
1291
1292         /*
1293          * Determine scope.
1294          * If there is nothing on the line after the conditional,
1295          * not even whitespace, use next-line scope.
1296          */
1297
1298         if ('\0' == (*bufp)[pos]) {
1299                 r->last->endspan = 2;
1300                 goto out;
1301         }
1302
1303         while (' ' == (*bufp)[pos])
1304                 pos++;
1305
1306         /* An opening brace requests multiline scope. */
1307
1308         if ('\\' == (*bufp)[pos] && '{' == (*bufp)[pos + 1]) {
1309                 r->last->endspan = -1;
1310                 pos += 2;
1311                 goto out;
1312         }
1313
1314         /*
1315          * Anything else following the conditional causes
1316          * single-line scope.  Warn if the scope contains
1317          * nothing but trailing whitespace.
1318          */
1319
1320         if ('\0' == (*bufp)[pos])
1321                 mandoc_msg(MANDOCERR_NOARGS, r->parse, ln, ppos, NULL);
1322
1323         r->last->endspan = 1;
1324
1325 out:
1326         *offs = pos;
1327         return(ROFF_RERUN);
1328 }
1329
1330
1331 /* ARGSUSED */
1332 static enum rofferr
1333 roff_ds(ROFF_ARGS)
1334 {
1335         char            *name, *string;
1336
1337         /*
1338          * A symbol is named by the first word following the macro
1339          * invocation up to a space.  Its value is anything after the
1340          * name's trailing whitespace and optional double-quote.  Thus,
1341          *
1342          *  [.ds foo "bar  "     ]
1343          *
1344          * will have `bar  "     ' as its value.
1345          */
1346
1347         string = *bufp + pos;
1348         name = roff_getname(r, &string, ln, pos);
1349         if ('\0' == *name)
1350                 return(ROFF_IGN);
1351
1352         /* Read past initial double-quote. */
1353         if ('"' == *string)
1354                 string++;
1355
1356         /* The rest is the value. */
1357         roff_setstr(r, name, string, 0);
1358         return(ROFF_IGN);
1359 }
1360
1361 void
1362 roff_setreg(struct roff *r, const char *name, int val, char sign)
1363 {
1364         struct roffreg  *reg;
1365
1366         /* Search for an existing register with the same name. */
1367         reg = r->regtab;
1368
1369         while (reg && strcmp(name, reg->key.p))
1370                 reg = reg->next;
1371
1372         if (NULL == reg) {
1373                 /* Create a new register. */
1374                 reg = mandoc_malloc(sizeof(struct roffreg));
1375                 reg->key.p = mandoc_strdup(name);
1376                 reg->key.sz = strlen(name);
1377                 reg->val = 0;
1378                 reg->next = r->regtab;
1379                 r->regtab = reg;
1380         }
1381
1382         if ('+' == sign)
1383                 reg->val += val;
1384         else if ('-' == sign)
1385                 reg->val -= val;
1386         else
1387                 reg->val = val;
1388 }
1389
1390 int
1391 roff_getreg(const struct roff *r, const char *name)
1392 {
1393         struct roffreg  *reg;
1394
1395         for (reg = r->regtab; reg; reg = reg->next)
1396                 if (0 == strcmp(name, reg->key.p))
1397                         return(reg->val);
1398
1399         return(0);
1400 }
1401
1402 static int
1403 roff_getregn(const struct roff *r, const char *name, size_t len)
1404 {
1405         struct roffreg  *reg;
1406
1407         for (reg = r->regtab; reg; reg = reg->next)
1408                 if (len == reg->key.sz &&
1409                     0 == strncmp(name, reg->key.p, len))
1410                         return(reg->val);
1411
1412         return(0);
1413 }
1414
1415 static void
1416 roff_freereg(struct roffreg *reg)
1417 {
1418         struct roffreg  *old_reg;
1419
1420         while (NULL != reg) {
1421                 free(reg->key.p);
1422                 old_reg = reg;
1423                 reg = reg->next;
1424                 free(old_reg);
1425         }
1426 }
1427
1428 /* ARGSUSED */
1429 static enum rofferr
1430 roff_nr(ROFF_ARGS)
1431 {
1432         const char      *key;
1433         char            *val;
1434         size_t           sz;
1435         int              iv;
1436         char             sign;
1437
1438         val = *bufp + pos;
1439         key = roff_getname(r, &val, ln, pos);
1440
1441         sign = *val;
1442         if ('+' == sign || '-' == sign)
1443                 val++;
1444
1445         sz = strspn(val, "0123456789");
1446         iv = sz ? mandoc_strntoi(val, sz, 10) : 0;
1447
1448         roff_setreg(r, key, iv, sign);
1449
1450         return(ROFF_IGN);
1451 }
1452
1453 /* ARGSUSED */
1454 static enum rofferr
1455 roff_rm(ROFF_ARGS)
1456 {
1457         const char       *name;
1458         char             *cp;
1459
1460         cp = *bufp + pos;
1461         while ('\0' != *cp) {
1462                 name = roff_getname(r, &cp, ln, (int)(cp - *bufp));
1463                 if ('\0' != *name)
1464                         roff_setstr(r, name, NULL, 0);
1465         }
1466         return(ROFF_IGN);
1467 }
1468
1469 /* ARGSUSED */
1470 static enum rofferr
1471 roff_it(ROFF_ARGS)
1472 {
1473         char            *cp;
1474         size_t           len;
1475         int              iv;
1476
1477         /* Parse the number of lines. */
1478         cp = *bufp + pos;
1479         len = strcspn(cp, " \t");
1480         cp[len] = '\0';
1481         if ((iv = mandoc_strntoi(cp, len, 10)) <= 0) {
1482                 mandoc_msg(MANDOCERR_NUMERIC, r->parse,
1483                                 ln, ppos, *bufp + 1);
1484                 return(ROFF_IGN);
1485         }
1486         cp += len + 1;
1487
1488         /* Arm the input line trap. */
1489         roffit_lines = iv;
1490         roffit_macro = mandoc_strdup(cp);
1491         return(ROFF_IGN);
1492 }
1493
1494 /* ARGSUSED */
1495 static enum rofferr
1496 roff_Dd(ROFF_ARGS)
1497 {
1498         const char *const       *cp;
1499
1500         if (MPARSE_MDOC != r->parsetype)
1501                 for (cp = __mdoc_reserved; *cp; cp++)
1502                         roff_setstr(r, *cp, NULL, 0);
1503
1504         return(ROFF_CONT);
1505 }
1506
1507 /* ARGSUSED */
1508 static enum rofferr
1509 roff_TH(ROFF_ARGS)
1510 {
1511         const char *const       *cp;
1512
1513         if (MPARSE_MDOC != r->parsetype)
1514                 for (cp = __man_reserved; *cp; cp++)
1515                         roff_setstr(r, *cp, NULL, 0);
1516
1517         return(ROFF_CONT);
1518 }
1519
1520 /* ARGSUSED */
1521 static enum rofferr
1522 roff_TE(ROFF_ARGS)
1523 {
1524
1525         if (NULL == r->tbl)
1526                 mandoc_msg(MANDOCERR_NOSCOPE, r->parse, ln, ppos, NULL);
1527         else
1528                 tbl_end(&r->tbl);
1529
1530         return(ROFF_IGN);
1531 }
1532
1533 /* ARGSUSED */
1534 static enum rofferr
1535 roff_T_(ROFF_ARGS)
1536 {
1537
1538         if (NULL == r->tbl)
1539                 mandoc_msg(MANDOCERR_NOSCOPE, r->parse, ln, ppos, NULL);
1540         else
1541                 tbl_restart(ppos, ln, r->tbl);
1542
1543         return(ROFF_IGN);
1544 }
1545
1546 #if 0
1547 static int
1548 roff_closeeqn(struct roff *r)
1549 {
1550
1551         return(r->eqn && ROFF_EQN == eqn_end(&r->eqn) ? 1 : 0);
1552 }
1553 #endif
1554
1555 static void
1556 roff_openeqn(struct roff *r, const char *name, int line,
1557                 int offs, const char *buf)
1558 {
1559         struct eqn_node *e;
1560         int              poff;
1561
1562         assert(NULL == r->eqn);
1563         e = eqn_alloc(name, offs, line, r->parse);
1564
1565         if (r->last_eqn)
1566                 r->last_eqn->next = e;
1567         else
1568                 r->first_eqn = r->last_eqn = e;
1569
1570         r->eqn = r->last_eqn = e;
1571
1572         if (buf) {
1573                 poff = 0;
1574                 eqn_read(&r->eqn, line, buf, offs, &poff);
1575         }
1576 }
1577
1578 /* ARGSUSED */
1579 static enum rofferr
1580 roff_EQ(ROFF_ARGS)
1581 {
1582
1583         roff_openeqn(r, *bufp + pos, ln, ppos, NULL);
1584         return(ROFF_IGN);
1585 }
1586
1587 /* ARGSUSED */
1588 static enum rofferr
1589 roff_EN(ROFF_ARGS)
1590 {
1591
1592         mandoc_msg(MANDOCERR_NOSCOPE, r->parse, ln, ppos, NULL);
1593         return(ROFF_IGN);
1594 }
1595
1596 /* ARGSUSED */
1597 static enum rofferr
1598 roff_TS(ROFF_ARGS)
1599 {
1600         struct tbl_node *tbl;
1601
1602         if (r->tbl) {
1603                 mandoc_msg(MANDOCERR_SCOPEBROKEN, r->parse, ln, ppos, NULL);
1604                 tbl_end(&r->tbl);
1605         }
1606
1607         tbl = tbl_alloc(ppos, ln, r->parse);
1608
1609         if (r->last_tbl)
1610                 r->last_tbl->next = tbl;
1611         else
1612                 r->first_tbl = r->last_tbl = tbl;
1613
1614         r->tbl = r->last_tbl = tbl;
1615         return(ROFF_IGN);
1616 }
1617
1618 /* ARGSUSED */
1619 static enum rofferr
1620 roff_cc(ROFF_ARGS)
1621 {
1622         const char      *p;
1623
1624         p = *bufp + pos;
1625
1626         if ('\0' == *p || '.' == (r->control = *p++))
1627                 r->control = 0;
1628
1629         if ('\0' != *p)
1630                 mandoc_msg(MANDOCERR_ARGCOUNT, r->parse, ln, ppos, NULL);
1631
1632         return(ROFF_IGN);
1633 }
1634
1635 /* ARGSUSED */
1636 static enum rofferr
1637 roff_tr(ROFF_ARGS)
1638 {
1639         const char      *p, *first, *second;
1640         size_t           fsz, ssz;
1641         enum mandoc_esc  esc;
1642
1643         p = *bufp + pos;
1644
1645         if ('\0' == *p) {
1646                 mandoc_msg(MANDOCERR_ARGCOUNT, r->parse, ln, ppos, NULL);
1647                 return(ROFF_IGN);
1648         }
1649
1650         while ('\0' != *p) {
1651                 fsz = ssz = 1;
1652
1653                 first = p++;
1654                 if ('\\' == *first) {
1655                         esc = mandoc_escape(&p, NULL, NULL);
1656                         if (ESCAPE_ERROR == esc) {
1657                                 mandoc_msg
1658                                         (MANDOCERR_BADESCAPE, r->parse,
1659                                          ln, (int)(p - *bufp), NULL);
1660                                 return(ROFF_IGN);
1661                         }
1662                         fsz = (size_t)(p - first);
1663                 }
1664
1665                 second = p++;
1666                 if ('\\' == *second) {
1667                         esc = mandoc_escape(&p, NULL, NULL);
1668                         if (ESCAPE_ERROR == esc) {
1669                                 mandoc_msg
1670                                         (MANDOCERR_BADESCAPE, r->parse,
1671                                          ln, (int)(p - *bufp), NULL);
1672                                 return(ROFF_IGN);
1673                         }
1674                         ssz = (size_t)(p - second);
1675                 } else if ('\0' == *second) {
1676                         mandoc_msg(MANDOCERR_ARGCOUNT, r->parse,
1677                                         ln, (int)(p - *bufp), NULL);
1678                         second = " ";
1679                         p--;
1680                 }
1681
1682                 if (fsz > 1) {
1683                         roff_setstrn(&r->xmbtab, first,
1684                                         fsz, second, ssz, 0);
1685                         continue;
1686                 }
1687
1688                 if (NULL == r->xtab)
1689                         r->xtab = mandoc_calloc
1690                                 (128, sizeof(struct roffstr));
1691
1692                 free(r->xtab[(int)*first].p);
1693                 r->xtab[(int)*first].p = mandoc_strndup(second, ssz);
1694                 r->xtab[(int)*first].sz = ssz;
1695         }
1696
1697         return(ROFF_IGN);
1698 }
1699
1700 /* ARGSUSED */
1701 static enum rofferr
1702 roff_so(ROFF_ARGS)
1703 {
1704         char *name;
1705
1706         mandoc_msg(MANDOCERR_SO, r->parse, ln, ppos, NULL);
1707
1708         /*
1709          * Handle `so'.  Be EXTREMELY careful, as we shouldn't be
1710          * opening anything that's not in our cwd or anything beneath
1711          * it.  Thus, explicitly disallow traversing up the file-system
1712          * or using absolute paths.
1713          */
1714
1715         name = *bufp + pos;
1716         if ('/' == *name || strstr(name, "../") || strstr(name, "/..")) {
1717                 mandoc_msg(MANDOCERR_SOPATH, r->parse, ln, pos, NULL);
1718                 return(ROFF_ERR);
1719         }
1720
1721         *offs = pos;
1722         return(ROFF_SO);
1723 }
1724
1725 /* ARGSUSED */
1726 static enum rofferr
1727 roff_userdef(ROFF_ARGS)
1728 {
1729         const char       *arg[9];
1730         char             *cp, *n1, *n2;
1731         int               i;
1732
1733         /*
1734          * Collect pointers to macro argument strings
1735          * and NUL-terminate them.
1736          */
1737         cp = *bufp + pos;
1738         for (i = 0; i < 9; i++)
1739                 arg[i] = '\0' == *cp ? "" :
1740                     mandoc_getarg(r->parse, &cp, ln, &pos);
1741
1742         /*
1743          * Expand macro arguments.
1744          */
1745         *szp = 0;
1746         n1 = cp = mandoc_strdup(r->current_string);
1747         while (NULL != (cp = strstr(cp, "\\$"))) {
1748                 i = cp[2] - '1';
1749                 if (0 > i || 8 < i) {
1750                         /* Not an argument invocation. */
1751                         cp += 2;
1752                         continue;
1753                 }
1754
1755                 *szp = strlen(n1) - 3 + strlen(arg[i]) + 1;
1756                 n2 = mandoc_malloc(*szp);
1757
1758                 strlcpy(n2, n1, (size_t)(cp - n1 + 1));
1759                 strlcat(n2, arg[i], *szp);
1760                 strlcat(n2, cp + 3, *szp);
1761
1762                 cp = n2 + (cp - n1);
1763                 free(n1);
1764                 n1 = n2;
1765         }
1766
1767         /*
1768          * Replace the macro invocation
1769          * by the expanded macro.
1770          */
1771         free(*bufp);
1772         *bufp = n1;
1773         if (0 == *szp)
1774                 *szp = strlen(*bufp) + 1;
1775
1776         return(*szp > 1 && '\n' == (*bufp)[(int)*szp - 2] ?
1777            ROFF_REPARSE : ROFF_APPEND);
1778 }
1779
1780 static char *
1781 roff_getname(struct roff *r, char **cpp, int ln, int pos)
1782 {
1783         char     *name, *cp;
1784
1785         name = *cpp;
1786         if ('\0' == *name)
1787                 return(name);
1788
1789         /* Read until end of name. */
1790         for (cp = name; '\0' != *cp && ' ' != *cp; cp++) {
1791                 if ('\\' != *cp)
1792                         continue;
1793                 cp++;
1794                 if ('\\' == *cp)
1795                         continue;
1796                 mandoc_msg(MANDOCERR_NAMESC, r->parse, ln, pos, NULL);
1797                 *cp = '\0';
1798                 name = cp;
1799         }
1800
1801         /* Nil-terminate name. */
1802         if ('\0' != *cp)
1803                 *(cp++) = '\0';
1804
1805         /* Read past spaces. */
1806         while (' ' == *cp)
1807                 cp++;
1808
1809         *cpp = cp;
1810         return(name);
1811 }
1812
1813 /*
1814  * Store *string into the user-defined string called *name.
1815  * In multiline mode, append to an existing entry and append '\n';
1816  * else replace the existing entry, if there is one.
1817  * To clear an existing entry, call with (*r, *name, NULL, 0).
1818  */
1819 static void
1820 roff_setstr(struct roff *r, const char *name, const char *string,
1821         int multiline)
1822 {
1823
1824         roff_setstrn(&r->strtab, name, strlen(name), string,
1825                         string ? strlen(string) : 0, multiline);
1826 }
1827
1828 static void
1829 roff_setstrn(struct roffkv **r, const char *name, size_t namesz,
1830                 const char *string, size_t stringsz, int multiline)
1831 {
1832         struct roffkv   *n;
1833         char            *c;
1834         int              i;
1835         size_t           oldch, newch;
1836
1837         /* Search for an existing string with the same name. */
1838         n = *r;
1839
1840         while (n && strcmp(name, n->key.p))
1841                 n = n->next;
1842
1843         if (NULL == n) {
1844                 /* Create a new string table entry. */
1845                 n = mandoc_malloc(sizeof(struct roffkv));
1846                 n->key.p = mandoc_strndup(name, namesz);
1847                 n->key.sz = namesz;
1848                 n->val.p = NULL;
1849                 n->val.sz = 0;
1850                 n->next = *r;
1851                 *r = n;
1852         } else if (0 == multiline) {
1853                 /* In multiline mode, append; else replace. */
1854                 free(n->val.p);
1855                 n->val.p = NULL;
1856                 n->val.sz = 0;
1857         }
1858
1859         if (NULL == string)
1860                 return;
1861
1862         /*
1863          * One additional byte for the '\n' in multiline mode,
1864          * and one for the terminating '\0'.
1865          */
1866         newch = stringsz + (multiline ? 2u : 1u);
1867
1868         if (NULL == n->val.p) {
1869                 n->val.p = mandoc_malloc(newch);
1870                 *n->val.p = '\0';
1871                 oldch = 0;
1872         } else {
1873                 oldch = n->val.sz;
1874                 n->val.p = mandoc_realloc(n->val.p, oldch + newch);
1875         }
1876
1877         /* Skip existing content in the destination buffer. */
1878         c = n->val.p + (int)oldch;
1879
1880         /* Append new content to the destination buffer. */
1881         i = 0;
1882         while (i < (int)stringsz) {
1883                 /*
1884                  * Rudimentary roff copy mode:
1885                  * Handle escaped backslashes.
1886                  */
1887                 if ('\\' == string[i] && '\\' == string[i + 1])
1888                         i++;
1889                 *c++ = string[i++];
1890         }
1891
1892         /* Append terminating bytes. */
1893         if (multiline)
1894                 *c++ = '\n';
1895
1896         *c = '\0';
1897         n->val.sz = (int)(c - n->val.p);
1898 }
1899
1900 static const char *
1901 roff_getstrn(const struct roff *r, const char *name, size_t len)
1902 {
1903         const struct roffkv *n;
1904
1905         for (n = r->strtab; n; n = n->next)
1906                 if (0 == strncmp(name, n->key.p, len) &&
1907                                 '\0' == n->key.p[(int)len])
1908                         return(n->val.p);
1909
1910         return(NULL);
1911 }
1912
1913 static void
1914 roff_freestr(struct roffkv *r)
1915 {
1916         struct roffkv    *n, *nn;
1917
1918         for (n = r; n; n = nn) {
1919                 free(n->key.p);
1920                 free(n->val.p);
1921                 nn = n->next;
1922                 free(n);
1923         }
1924 }
1925
1926 const struct tbl_span *
1927 roff_span(const struct roff *r)
1928 {
1929
1930         return(r->tbl ? tbl_span(r->tbl) : NULL);
1931 }
1932
1933 const struct eqn *
1934 roff_eqn(const struct roff *r)
1935 {
1936
1937         return(r->last_eqn ? &r->last_eqn->eqn : NULL);
1938 }
1939
1940 /*
1941  * Duplicate an input string, making the appropriate character
1942  * conversations (as stipulated by `tr') along the way.
1943  * Returns a heap-allocated string with all the replacements made.
1944  */
1945 char *
1946 roff_strdup(const struct roff *r, const char *p)
1947 {
1948         const struct roffkv *cp;
1949         char            *res;
1950         const char      *pp;
1951         size_t           ssz, sz;
1952         enum mandoc_esc  esc;
1953
1954         if (NULL == r->xmbtab && NULL == r->xtab)
1955                 return(mandoc_strdup(p));
1956         else if ('\0' == *p)
1957                 return(mandoc_strdup(""));
1958
1959         /*
1960          * Step through each character looking for term matches
1961          * (remember that a `tr' can be invoked with an escape, which is
1962          * a glyph but the escape is multi-character).
1963          * We only do this if the character hash has been initialised
1964          * and the string is >0 length.
1965          */
1966
1967         res = NULL;
1968         ssz = 0;
1969
1970         while ('\0' != *p) {
1971                 if ('\\' != *p && r->xtab && r->xtab[(int)*p].p) {
1972                         sz = r->xtab[(int)*p].sz;
1973                         res = mandoc_realloc(res, ssz + sz + 1);
1974                         memcpy(res + ssz, r->xtab[(int)*p].p, sz);
1975                         ssz += sz;
1976                         p++;
1977                         continue;
1978                 } else if ('\\' != *p) {
1979                         res = mandoc_realloc(res, ssz + 2);
1980                         res[ssz++] = *p++;
1981                         continue;
1982                 }
1983
1984                 /* Search for term matches. */
1985                 for (cp = r->xmbtab; cp; cp = cp->next)
1986                         if (0 == strncmp(p, cp->key.p, cp->key.sz))
1987                                 break;
1988
1989                 if (NULL != cp) {
1990                         /*
1991                          * A match has been found.
1992                          * Append the match to the array and move
1993                          * forward by its keysize.
1994                          */
1995                         res = mandoc_realloc
1996                                 (res, ssz + cp->val.sz + 1);
1997                         memcpy(res + ssz, cp->val.p, cp->val.sz);
1998                         ssz += cp->val.sz;
1999                         p += (int)cp->key.sz;
2000                         continue;
2001                 }
2002
2003                 /*
2004                  * Handle escapes carefully: we need to copy
2005                  * over just the escape itself, or else we might
2006                  * do replacements within the escape itself.
2007                  * Make sure to pass along the bogus string.
2008                  */
2009                 pp = p++;
2010                 esc = mandoc_escape(&p, NULL, NULL);
2011                 if (ESCAPE_ERROR == esc) {
2012                         sz = strlen(pp);
2013                         res = mandoc_realloc(res, ssz + sz + 1);
2014                         memcpy(res + ssz, pp, sz);
2015                         break;
2016                 }
2017                 /*
2018                  * We bail out on bad escapes.
2019                  * No need to warn: we already did so when
2020                  * roff_res() was called.
2021                  */
2022                 sz = (int)(p - pp);
2023                 res = mandoc_realloc(res, ssz + sz + 1);
2024                 memcpy(res + ssz, pp, sz);
2025                 ssz += sz;
2026         }
2027
2028         res[(int)ssz] = '\0';
2029         return(res);
2030 }
2031
2032 /*
2033  * Find out whether a line is a macro line or not.
2034  * If it is, adjust the current position and return one; if it isn't,
2035  * return zero and don't change the current position.
2036  * If the control character has been set with `.cc', then let that grain
2037  * precedence.
2038  * This is slighly contrary to groff, where using the non-breaking
2039  * control character when `cc' has been invoked will cause the
2040  * non-breaking macro contents to be printed verbatim.
2041  */
2042 int
2043 roff_getcontrol(const struct roff *r, const char *cp, int *ppos)
2044 {
2045         int             pos;
2046
2047         pos = *ppos;
2048
2049         if (0 != r->control && cp[pos] == r->control)
2050                 pos++;
2051         else if (0 != r->control)
2052                 return(0);
2053         else if ('\\' == cp[pos] && '.' == cp[pos + 1])
2054                 pos += 2;
2055         else if ('.' == cp[pos] || '\'' == cp[pos])
2056                 pos++;
2057         else
2058                 return(0);
2059
2060         while (' ' == cp[pos] || '\t' == cp[pos])
2061                 pos++;
2062
2063         *ppos = pos;
2064         return(1);
2065 }