xref: /netbsd/external/bsd/mdocml/dist/roff.c (revision 6550d01e)
1 /*	$Vendor-Id: roff.c,v 1.120 2011/01/03 23:24:16 schwarze Exp $ */
2 /*
3  * Copyright (c) 2010, 2011 Kristaps Dzonsons <kristaps@bsd.lv>
4  * Copyright (c) 2010, 2011 Ingo Schwarze <schwarze@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHORS DISCLAIM ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 #ifdef HAVE_CONFIG_H
19 #include "config.h"
20 #endif
21 
22 #include <assert.h>
23 #include <errno.h>
24 #include <ctype.h>
25 #include <limits.h>
26 #include <stdlib.h>
27 #include <string.h>
28 #include <stdio.h>
29 
30 #include "mandoc.h"
31 #include "roff.h"
32 #include "libroff.h"
33 #include "libmandoc.h"
34 
35 #define	RSTACK_MAX	128
36 
37 #define	ROFF_CTL(c) \
38 	('.' == (c) || '\'' == (c))
39 
40 enum	rofft {
41 	ROFF_ad,
42 	ROFF_am,
43 	ROFF_ami,
44 	ROFF_am1,
45 	ROFF_de,
46 	ROFF_dei,
47 	ROFF_de1,
48 	ROFF_ds,
49 	ROFF_el,
50 	ROFF_hy,
51 	ROFF_ie,
52 	ROFF_if,
53 	ROFF_ig,
54 	ROFF_ne,
55 	ROFF_nh,
56 	ROFF_nr,
57 	ROFF_rm,
58 	ROFF_so,
59 	ROFF_tr,
60 	ROFF_TS,
61 	ROFF_TE,
62 	ROFF_T_,
63 	ROFF_cblock,
64 	ROFF_ccond, /* FIXME: remove this. */
65 	ROFF_USERDEF,
66 	ROFF_MAX
67 };
68 
69 enum	roffrule {
70 	ROFFRULE_ALLOW,
71 	ROFFRULE_DENY
72 };
73 
74 struct	roffstr {
75 	char		*name; /* key of symbol */
76 	char		*string; /* current value */
77 	struct roffstr	*next; /* next in list */
78 };
79 
80 struct	roff {
81 	struct roffnode	*last; /* leaf of stack */
82 	mandocmsg	 msg; /* err/warn/fatal messages */
83 	void		*data; /* privdata for messages */
84 	enum roffrule	 rstack[RSTACK_MAX]; /* stack of !`ie' rules */
85 	int		 rstackpos; /* position in rstack */
86 	struct regset	*regs; /* read/writable registers */
87 	struct roffstr	*first_string; /* user-defined strings & macros */
88 	const char	*current_string; /* value of last called user macro */
89 	struct tbl_node	*first_tbl; /* first table parsed */
90 	struct tbl_node	*last_tbl; /* last table parsed */
91 	struct tbl_node	*tbl; /* current table being parsed */
92 };
93 
94 struct	roffnode {
95 	enum rofft	 tok; /* type of node */
96 	struct roffnode	*parent; /* up one in stack */
97 	int		 line; /* parse line */
98 	int		 col; /* parse col */
99 	char		*name; /* node name, e.g. macro name */
100 	char		*end; /* end-rules: custom token */
101 	int		 endspan; /* end-rules: next-line or infty */
102 	enum roffrule	 rule; /* current evaluation rule */
103 };
104 
105 #define	ROFF_ARGS	 struct roff *r, /* parse ctx */ \
106 			 enum rofft tok, /* tok of macro */ \
107 		 	 char **bufp, /* input buffer */ \
108 			 size_t *szp, /* size of input buffer */ \
109 			 int ln, /* parse line */ \
110 			 int ppos, /* original pos in buffer */ \
111 			 int pos, /* current pos in buffer */ \
112 			 int *offs /* reset offset of buffer data */
113 
114 typedef	enum rofferr (*roffproc)(ROFF_ARGS);
115 
116 struct	roffmac {
117 	const char	*name; /* macro name */
118 	roffproc	 proc; /* process new macro */
119 	roffproc	 text; /* process as child text of macro */
120 	roffproc	 sub; /* process as child of macro */
121 	int		 flags;
122 #define	ROFFMAC_STRUCT	(1 << 0) /* always interpret */
123 	struct roffmac	*next;
124 };
125 
126 static	enum rofferr	 roff_block(ROFF_ARGS);
127 static	enum rofferr	 roff_block_text(ROFF_ARGS);
128 static	enum rofferr	 roff_block_sub(ROFF_ARGS);
129 static	enum rofferr	 roff_cblock(ROFF_ARGS);
130 static	enum rofferr	 roff_ccond(ROFF_ARGS);
131 static	enum rofferr	 roff_cond(ROFF_ARGS);
132 static	enum rofferr	 roff_cond_text(ROFF_ARGS);
133 static	enum rofferr	 roff_cond_sub(ROFF_ARGS);
134 static	enum rofferr	 roff_ds(ROFF_ARGS);
135 static	enum roffrule	 roff_evalcond(const char *, int *);
136 static	void		 roff_freestr(struct roff *);
137 static	const char	*roff_getstrn(const struct roff *,
138 				const char *, size_t);
139 static	enum rofferr	 roff_line_ignore(ROFF_ARGS);
140 static	enum rofferr	 roff_line_error(ROFF_ARGS);
141 static	enum rofferr	 roff_nr(ROFF_ARGS);
142 static	int		 roff_res(struct roff *,
143 				char **, size_t *, int);
144 static	void		 roff_setstr(struct roff *,
145 				const char *, const char *, int);
146 static	enum rofferr	 roff_so(ROFF_ARGS);
147 static	enum rofferr	 roff_TE(ROFF_ARGS);
148 static	enum rofferr	 roff_TS(ROFF_ARGS);
149 static	enum rofferr	 roff_T_(ROFF_ARGS);
150 static	enum rofferr	 roff_userdef(ROFF_ARGS);
151 
152 /* See roff_hash_find() */
153 
154 #define	ASCII_HI	 126
155 #define	ASCII_LO	 33
156 #define	HASHWIDTH	(ASCII_HI - ASCII_LO + 1)
157 
158 static	struct roffmac	*hash[HASHWIDTH];
159 
160 static	struct roffmac	 roffs[ROFF_MAX] = {
161 	{ "ad", roff_line_ignore, NULL, NULL, 0, NULL },
162 	{ "am", roff_block, roff_block_text, roff_block_sub, 0, NULL },
163 	{ "ami", roff_block, roff_block_text, roff_block_sub, 0, NULL },
164 	{ "am1", roff_block, roff_block_text, roff_block_sub, 0, NULL },
165 	{ "de", roff_block, roff_block_text, roff_block_sub, 0, NULL },
166 	{ "dei", roff_block, roff_block_text, roff_block_sub, 0, NULL },
167 	{ "de1", roff_block, roff_block_text, roff_block_sub, 0, NULL },
168 	{ "ds", roff_ds, NULL, NULL, 0, NULL },
169 	{ "el", roff_cond, roff_cond_text, roff_cond_sub, ROFFMAC_STRUCT, NULL },
170 	{ "hy", roff_line_ignore, NULL, NULL, 0, NULL },
171 	{ "ie", roff_cond, roff_cond_text, roff_cond_sub, ROFFMAC_STRUCT, NULL },
172 	{ "if", roff_cond, roff_cond_text, roff_cond_sub, ROFFMAC_STRUCT, NULL },
173 	{ "ig", roff_block, roff_block_text, roff_block_sub, 0, NULL },
174 	{ "ne", roff_line_ignore, NULL, NULL, 0, NULL },
175 	{ "nh", roff_line_ignore, NULL, NULL, 0, NULL },
176 	{ "nr", roff_nr, NULL, NULL, 0, NULL },
177 	{ "rm", roff_line_error, NULL, NULL, 0, NULL },
178 	{ "so", roff_so, NULL, NULL, 0, NULL },
179 	{ "tr", roff_line_ignore, NULL, NULL, 0, NULL },
180 	{ "TS", roff_TS, NULL, NULL, 0, NULL },
181 	{ "TE", roff_TE, NULL, NULL, 0, NULL },
182 	{ "T&", roff_T_, NULL, NULL, 0, NULL },
183 	{ ".", roff_cblock, NULL, NULL, 0, NULL },
184 	{ "\\}", roff_ccond, NULL, NULL, 0, NULL },
185 	{ NULL, roff_userdef, NULL, NULL, 0, NULL },
186 };
187 
188 static	void		 roff_free1(struct roff *);
189 static	enum rofft	 roff_hash_find(const char *, size_t);
190 static	void		 roff_hash_init(void);
191 static	void		 roffnode_cleanscope(struct roff *);
192 static	void		 roffnode_push(struct roff *, enum rofft,
193 				const char *, int, int);
194 static	void		 roffnode_pop(struct roff *);
195 static	enum rofft	 roff_parse(struct roff *, const char *, int *);
196 static	int		 roff_parse_nat(const char *, unsigned int *);
197 
198 /* See roff_hash_find() */
199 #define	ROFF_HASH(p)	(p[0] - ASCII_LO)
200 
201 static void
202 roff_hash_init(void)
203 {
204 	struct roffmac	 *n;
205 	int		  buc, i;
206 
207 	for (i = 0; i < (int)ROFF_USERDEF; i++) {
208 		assert(roffs[i].name[0] >= ASCII_LO);
209 		assert(roffs[i].name[0] <= ASCII_HI);
210 
211 		buc = ROFF_HASH(roffs[i].name);
212 
213 		if (NULL != (n = hash[buc])) {
214 			for ( ; n->next; n = n->next)
215 				/* Do nothing. */ ;
216 			n->next = &roffs[i];
217 		} else
218 			hash[buc] = &roffs[i];
219 	}
220 }
221 
222 
223 /*
224  * Look up a roff token by its name.  Returns ROFF_MAX if no macro by
225  * the nil-terminated string name could be found.
226  */
227 static enum rofft
228 roff_hash_find(const char *p, size_t s)
229 {
230 	int		 buc;
231 	struct roffmac	*n;
232 
233 	/*
234 	 * libroff has an extremely simple hashtable, for the time
235 	 * being, which simply keys on the first character, which must
236 	 * be printable, then walks a chain.  It works well enough until
237 	 * optimised.
238 	 */
239 
240 	if (p[0] < ASCII_LO || p[0] > ASCII_HI)
241 		return(ROFF_MAX);
242 
243 	buc = ROFF_HASH(p);
244 
245 	if (NULL == (n = hash[buc]))
246 		return(ROFF_MAX);
247 	for ( ; n; n = n->next)
248 		if (0 == strncmp(n->name, p, s) && '\0' == n->name[(int)s])
249 			return((enum rofft)(n - roffs));
250 
251 	return(ROFF_MAX);
252 }
253 
254 
255 /*
256  * Pop the current node off of the stack of roff instructions currently
257  * pending.
258  */
259 static void
260 roffnode_pop(struct roff *r)
261 {
262 	struct roffnode	*p;
263 
264 	assert(r->last);
265 	p = r->last;
266 
267 	if (ROFF_el == p->tok)
268 		if (r->rstackpos > -1)
269 			r->rstackpos--;
270 
271 	r->last = r->last->parent;
272 	free(p->name);
273 	free(p->end);
274 	free(p);
275 }
276 
277 
278 /*
279  * Push a roff node onto the instruction stack.  This must later be
280  * removed with roffnode_pop().
281  */
282 static void
283 roffnode_push(struct roff *r, enum rofft tok, const char *name,
284 		int line, int col)
285 {
286 	struct roffnode	*p;
287 
288 	p = mandoc_calloc(1, sizeof(struct roffnode));
289 	p->tok = tok;
290 	if (name)
291 		p->name = mandoc_strdup(name);
292 	p->parent = r->last;
293 	p->line = line;
294 	p->col = col;
295 	p->rule = p->parent ? p->parent->rule : ROFFRULE_DENY;
296 
297 	r->last = p;
298 }
299 
300 
301 static void
302 roff_free1(struct roff *r)
303 {
304 	struct tbl_node	*t;
305 
306 	while (r->first_tbl) {
307 		t = r->first_tbl;
308 		r->first_tbl = t->next;
309 		tbl_free(t);
310 	}
311 
312 	r->first_tbl = r->last_tbl = r->tbl = NULL;
313 
314 	while (r->last)
315 		roffnode_pop(r);
316 
317 	roff_freestr(r);
318 }
319 
320 
321 void
322 roff_reset(struct roff *r)
323 {
324 
325 	roff_free1(r);
326 }
327 
328 
329 void
330 roff_free(struct roff *r)
331 {
332 
333 	roff_free1(r);
334 	free(r);
335 }
336 
337 
338 struct roff *
339 roff_alloc(struct regset *regs, void *data, const mandocmsg msg)
340 {
341 	struct roff	*r;
342 
343 	r = mandoc_calloc(1, sizeof(struct roff));
344 	r->regs = regs;
345 	r->msg = msg;
346 	r->data = data;
347 	r->rstackpos = -1;
348 
349 	roff_hash_init();
350 	return(r);
351 }
352 
353 
354 /*
355  * Pre-filter each and every line for reserved words (one beginning with
356  * `\*', e.g., `\*(ab').  These must be handled before the actual line
357  * is processed.
358  */
359 static int
360 roff_res(struct roff *r, char **bufp, size_t *szp, int pos)
361 {
362 	const char	*stesc;	/* start of an escape sequence ('\\') */
363 	const char	*stnam;	/* start of the name, after "[(*" */
364 	const char	*cp;	/* end of the name, e.g. before ']' */
365 	const char	*res;	/* the string to be substituted */
366 	int		 i, maxl;
367 	size_t		 nsz;
368 	char		*n;
369 
370 	/* Search for a leading backslash and save a pointer to it. */
371 
372 	cp = *bufp + pos;
373 	while (NULL != (cp = strchr(cp, '\\'))) {
374 		stesc = cp++;
375 
376 		/*
377 		 * The second character must be an asterisk.
378 		 * If it isn't, skip it anyway:  It is escaped,
379 		 * so it can't start another escape sequence.
380 		 */
381 
382 		if ('\0' == *cp)
383 			return(1);
384 		if ('*' != *cp++)
385 			continue;
386 
387 		/*
388 		 * The third character decides the length
389 		 * of the name of the string.
390 		 * Save a pointer to the name.
391 		 */
392 
393 		switch (*cp) {
394 		case ('\0'):
395 			return(1);
396 		case ('('):
397 			cp++;
398 			maxl = 2;
399 			break;
400 		case ('['):
401 			cp++;
402 			maxl = 0;
403 			break;
404 		default:
405 			maxl = 1;
406 			break;
407 		}
408 		stnam = cp;
409 
410 		/* Advance to the end of the name. */
411 
412 		for (i = 0; 0 == maxl || i < maxl; i++, cp++) {
413 			if ('\0' == *cp)
414 				return(1); /* Error. */
415 			if (0 == maxl && ']' == *cp)
416 				break;
417 		}
418 
419 		/*
420 		 * Retrieve the replacement string; if it is
421 		 * undefined, resume searching for escapes.
422 		 */
423 
424 		res = roff_getstrn(r, stnam, (size_t)i);
425 
426 		if (NULL == res) {
427 			cp -= maxl ? 1 : 0;
428 			continue;
429 		}
430 
431 		/* Replace the escape sequence by the string. */
432 
433 		nsz = *szp + strlen(res) + 1;
434 		n = mandoc_malloc(nsz);
435 
436 		strlcpy(n, *bufp, (size_t)(stesc - *bufp + 1));
437 		strlcat(n, res, nsz);
438 		strlcat(n, cp + (maxl ? 0 : 1), nsz);
439 
440 		free(*bufp);
441 
442 		*bufp = n;
443 		*szp = nsz;
444 		return(0);
445 	}
446 
447 	return(1);
448 }
449 
450 
451 enum rofferr
452 roff_parseln(struct roff *r, int ln, char **bufp,
453 		size_t *szp, int pos, int *offs)
454 {
455 	enum rofft	 t;
456 	enum rofferr	 e;
457 	int		 ppos;
458 
459 	/*
460 	 * Run the reserved-word filter only if we have some reserved
461 	 * words to fill in.
462 	 */
463 
464 	if (r->first_string && ! roff_res(r, bufp, szp, pos))
465 		return(ROFF_REPARSE);
466 
467 	/*
468 	 * First, if a scope is open and we're not a macro, pass the
469 	 * text through the macro's filter.  If a scope isn't open and
470 	 * we're not a macro, just let it through.
471 	 */
472 
473 	if (r->last && ! ROFF_CTL((*bufp)[pos])) {
474 		t = r->last->tok;
475 		assert(roffs[t].text);
476 		e = (*roffs[t].text)
477 			(r, t, bufp, szp, ln, pos, pos, offs);
478 		assert(ROFF_IGN == e || ROFF_CONT == e);
479 		if (ROFF_CONT == e && r->tbl)
480 			return(tbl_read(r->tbl, ln, *bufp, *offs));
481 		return(e);
482 	} else if ( ! ROFF_CTL((*bufp)[pos])) {
483 		if (r->tbl)
484 			return(tbl_read(r->tbl, ln, *bufp, *offs));
485 		return(ROFF_CONT);
486 	}
487 
488 	/*
489 	 * If a scope is open, go to the child handler for that macro,
490 	 * as it may want to preprocess before doing anything with it.
491 	 */
492 
493 	if (r->last) {
494 		t = r->last->tok;
495 		assert(roffs[t].sub);
496 		return((*roffs[t].sub)
497 				(r, t, bufp, szp,
498 				 ln, pos, pos, offs));
499 	}
500 
501 	/*
502 	 * Lastly, as we've no scope open, try to look up and execute
503 	 * the new macro.  If no macro is found, simply return and let
504 	 * the compilers handle it.
505 	 */
506 
507 	ppos = pos;
508 	if (ROFF_MAX == (t = roff_parse(r, *bufp, &pos)))
509 		return(ROFF_CONT);
510 
511 	assert(roffs[t].proc);
512 	return((*roffs[t].proc)
513 			(r, t, bufp, szp,
514 			 ln, ppos, pos, offs));
515 }
516 
517 
518 void
519 roff_endparse(struct roff *r)
520 {
521 
522 	if (r->last)
523 		(*r->msg)(MANDOCERR_SCOPEEXIT, r->data,
524 				r->last->line, r->last->col, NULL);
525 
526 	if (r->tbl) {
527 		(*r->msg)(MANDOCERR_SCOPEEXIT, r->data,
528 				r->tbl->line, r->tbl->pos, NULL);
529 		tbl_end(r->tbl);
530 		r->tbl = NULL;
531 	}
532 }
533 
534 
535 /*
536  * Parse a roff node's type from the input buffer.  This must be in the
537  * form of ".foo xxx" in the usual way.
538  */
539 static enum rofft
540 roff_parse(struct roff *r, const char *buf, int *pos)
541 {
542 	const char	*mac;
543 	size_t		 maclen;
544 	enum rofft	 t;
545 
546 	assert(ROFF_CTL(buf[*pos]));
547 	(*pos)++;
548 
549 	while (' ' == buf[*pos] || '\t' == buf[*pos])
550 		(*pos)++;
551 
552 	if ('\0' == buf[*pos])
553 		return(ROFF_MAX);
554 
555 	mac = buf + *pos;
556 	maclen = strcspn(mac, " \\\t\0");
557 
558 	t = (r->current_string = roff_getstrn(r, mac, maclen))
559 	    ? ROFF_USERDEF : roff_hash_find(mac, maclen);
560 
561 	*pos += maclen;
562 	while (buf[*pos] && ' ' == buf[*pos])
563 		(*pos)++;
564 
565 	return(t);
566 }
567 
568 
569 static int
570 roff_parse_nat(const char *buf, unsigned int *res)
571 {
572 	char		*ep;
573 	long		 lval;
574 
575 	errno = 0;
576 	lval = strtol(buf, &ep, 10);
577 	if (buf[0] == '\0' || *ep != '\0')
578 		return(0);
579 	if ((errno == ERANGE &&
580 			(lval == LONG_MAX || lval == LONG_MIN)) ||
581 			(lval > INT_MAX || lval < 0))
582 		return(0);
583 
584 	*res = (unsigned int)lval;
585 	return(1);
586 }
587 
588 
589 /* ARGSUSED */
590 static enum rofferr
591 roff_cblock(ROFF_ARGS)
592 {
593 
594 	/*
595 	 * A block-close `..' should only be invoked as a child of an
596 	 * ignore macro, otherwise raise a warning and just ignore it.
597 	 */
598 
599 	if (NULL == r->last) {
600 		(*r->msg)(MANDOCERR_NOSCOPE, r->data, ln, ppos, NULL);
601 		return(ROFF_IGN);
602 	}
603 
604 	switch (r->last->tok) {
605 	case (ROFF_am):
606 		/* FALLTHROUGH */
607 	case (ROFF_ami):
608 		/* FALLTHROUGH */
609 	case (ROFF_am1):
610 		/* FALLTHROUGH */
611 	case (ROFF_de):
612 		/* ROFF_de1 is remapped to ROFF_de in roff_block(). */
613 		/* FALLTHROUGH */
614 	case (ROFF_dei):
615 		/* FALLTHROUGH */
616 	case (ROFF_ig):
617 		break;
618 	default:
619 		(*r->msg)(MANDOCERR_NOSCOPE, r->data, ln, ppos, NULL);
620 		return(ROFF_IGN);
621 	}
622 
623 	if ((*bufp)[pos])
624 		(*r->msg)(MANDOCERR_ARGSLOST, r->data, ln, pos, NULL);
625 
626 	roffnode_pop(r);
627 	roffnode_cleanscope(r);
628 	return(ROFF_IGN);
629 
630 }
631 
632 
633 static void
634 roffnode_cleanscope(struct roff *r)
635 {
636 
637 	while (r->last) {
638 		if (--r->last->endspan < 0)
639 			break;
640 		roffnode_pop(r);
641 	}
642 }
643 
644 
645 /* ARGSUSED */
646 static enum rofferr
647 roff_ccond(ROFF_ARGS)
648 {
649 
650 	if (NULL == r->last) {
651 		(*r->msg)(MANDOCERR_NOSCOPE, r->data, ln, ppos, NULL);
652 		return(ROFF_IGN);
653 	}
654 
655 	switch (r->last->tok) {
656 	case (ROFF_el):
657 		/* FALLTHROUGH */
658 	case (ROFF_ie):
659 		/* FALLTHROUGH */
660 	case (ROFF_if):
661 		break;
662 	default:
663 		(*r->msg)(MANDOCERR_NOSCOPE, r->data, ln, ppos, NULL);
664 		return(ROFF_IGN);
665 	}
666 
667 	if (r->last->endspan > -1) {
668 		(*r->msg)(MANDOCERR_NOSCOPE, r->data, ln, ppos, NULL);
669 		return(ROFF_IGN);
670 	}
671 
672 	if ((*bufp)[pos])
673 		(*r->msg)(MANDOCERR_ARGSLOST, r->data, ln, pos, NULL);
674 
675 	roffnode_pop(r);
676 	roffnode_cleanscope(r);
677 	return(ROFF_IGN);
678 }
679 
680 
681 /* ARGSUSED */
682 static enum rofferr
683 roff_block(ROFF_ARGS)
684 {
685 	int		sv;
686 	size_t		sz;
687 	char		*name;
688 
689 	name = NULL;
690 
691 	if (ROFF_ig != tok) {
692 		if ('\0' == (*bufp)[pos]) {
693 			(*r->msg)(MANDOCERR_NOARGS, r->data, ln, ppos, NULL);
694 			return(ROFF_IGN);
695 		}
696 
697 		/*
698 		 * Re-write `de1', since we don't really care about
699 		 * groff's strange compatibility mode, into `de'.
700 		 */
701 
702 		if (ROFF_de1 == tok)
703 			tok = ROFF_de;
704 		if (ROFF_de == tok)
705 			name = *bufp + pos;
706 		else
707 			(*r->msg)(MANDOCERR_REQUEST, r->data, ln, ppos,
708 			    roffs[tok].name);
709 
710 		while ((*bufp)[pos] && ' ' != (*bufp)[pos])
711 			pos++;
712 
713 		while (' ' == (*bufp)[pos])
714 			(*bufp)[pos++] = '\0';
715 	}
716 
717 	roffnode_push(r, tok, name, ln, ppos);
718 
719 	/*
720 	 * At the beginning of a `de' macro, clear the existing string
721 	 * with the same name, if there is one.  New content will be
722 	 * added from roff_block_text() in multiline mode.
723 	 */
724 
725 	if (ROFF_de == tok)
726 		roff_setstr(r, name, "", 0);
727 
728 	if ('\0' == (*bufp)[pos])
729 		return(ROFF_IGN);
730 
731 	/* If present, process the custom end-of-line marker. */
732 
733 	sv = pos;
734 	while ((*bufp)[pos] &&
735 			' ' != (*bufp)[pos] &&
736 			'\t' != (*bufp)[pos])
737 		pos++;
738 
739 	/*
740 	 * Note: groff does NOT like escape characters in the input.
741 	 * Instead of detecting this, we're just going to let it fly and
742 	 * to hell with it.
743 	 */
744 
745 	assert(pos > sv);
746 	sz = (size_t)(pos - sv);
747 
748 	if (1 == sz && '.' == (*bufp)[sv])
749 		return(ROFF_IGN);
750 
751 	r->last->end = mandoc_malloc(sz + 1);
752 
753 	memcpy(r->last->end, *bufp + sv, sz);
754 	r->last->end[(int)sz] = '\0';
755 
756 	if ((*bufp)[pos])
757 		(*r->msg)(MANDOCERR_ARGSLOST, r->data, ln, pos, NULL);
758 
759 	return(ROFF_IGN);
760 }
761 
762 
763 /* ARGSUSED */
764 static enum rofferr
765 roff_block_sub(ROFF_ARGS)
766 {
767 	enum rofft	t;
768 	int		i, j;
769 
770 	/*
771 	 * First check whether a custom macro exists at this level.  If
772 	 * it does, then check against it.  This is some of groff's
773 	 * stranger behaviours.  If we encountered a custom end-scope
774 	 * tag and that tag also happens to be a "real" macro, then we
775 	 * need to try interpreting it again as a real macro.  If it's
776 	 * not, then return ignore.  Else continue.
777 	 */
778 
779 	if (r->last->end) {
780 		i = pos + 1;
781 		while (' ' == (*bufp)[i] || '\t' == (*bufp)[i])
782 			i++;
783 
784 		for (j = 0; r->last->end[j]; j++, i++)
785 			if ((*bufp)[i] != r->last->end[j])
786 				break;
787 
788 		if ('\0' == r->last->end[j] &&
789 				('\0' == (*bufp)[i] ||
790 				 ' ' == (*bufp)[i] ||
791 				 '\t' == (*bufp)[i])) {
792 			roffnode_pop(r);
793 			roffnode_cleanscope(r);
794 
795 			if (ROFF_MAX != roff_parse(r, *bufp, &pos))
796 				return(ROFF_RERUN);
797 			return(ROFF_IGN);
798 		}
799 	}
800 
801 	/*
802 	 * If we have no custom end-query or lookup failed, then try
803 	 * pulling it out of the hashtable.
804 	 */
805 
806 	ppos = pos;
807 	t = roff_parse(r, *bufp, &pos);
808 
809 	/*
810 	 * Macros other than block-end are only significant
811 	 * in `de' blocks; elsewhere, simply throw them away.
812 	 */
813 	if (ROFF_cblock != t) {
814 		if (ROFF_de == tok)
815 			roff_setstr(r, r->last->name, *bufp + ppos, 1);
816 		return(ROFF_IGN);
817 	}
818 
819 	assert(roffs[t].proc);
820 	return((*roffs[t].proc)(r, t, bufp, szp,
821 				ln, ppos, pos, offs));
822 }
823 
824 
825 /* ARGSUSED */
826 static enum rofferr
827 roff_block_text(ROFF_ARGS)
828 {
829 
830 	if (ROFF_de == tok)
831 		roff_setstr(r, r->last->name, *bufp + pos, 1);
832 
833 	return(ROFF_IGN);
834 }
835 
836 
837 /* ARGSUSED */
838 static enum rofferr
839 roff_cond_sub(ROFF_ARGS)
840 {
841 	enum rofft	 t;
842 	enum roffrule	 rr;
843 
844 	ppos = pos;
845 	rr = r->last->rule;
846 
847 	/*
848 	 * Clean out scope.  If we've closed ourselves, then don't
849 	 * continue.
850 	 */
851 
852 	roffnode_cleanscope(r);
853 
854 	if (ROFF_MAX == (t = roff_parse(r, *bufp, &pos))) {
855 		if ('\\' == (*bufp)[pos] && '}' == (*bufp)[pos + 1])
856 			return(roff_ccond
857 				(r, ROFF_ccond, bufp, szp,
858 				 ln, pos, pos + 2, offs));
859 		return(ROFFRULE_DENY == rr ? ROFF_IGN : ROFF_CONT);
860 	}
861 
862 	/*
863 	 * A denied conditional must evaluate its children if and only
864 	 * if they're either structurally required (such as loops and
865 	 * conditionals) or a closing macro.
866 	 */
867 	if (ROFFRULE_DENY == rr)
868 		if ( ! (ROFFMAC_STRUCT & roffs[t].flags))
869 			if (ROFF_ccond != t)
870 				return(ROFF_IGN);
871 
872 	assert(roffs[t].proc);
873 	return((*roffs[t].proc)(r, t, bufp, szp,
874 				ln, ppos, pos, offs));
875 }
876 
877 
878 /* ARGSUSED */
879 static enum rofferr
880 roff_cond_text(ROFF_ARGS)
881 {
882 	char		*ep, *st;
883 	enum roffrule	 rr;
884 
885 	rr = r->last->rule;
886 
887 	/*
888 	 * We display the value of the text if out current evaluation
889 	 * scope permits us to do so.
890 	 */
891 
892 	/* FIXME: use roff_ccond? */
893 
894 	st = &(*bufp)[pos];
895 	if (NULL == (ep = strstr(st, "\\}"))) {
896 		roffnode_cleanscope(r);
897 		return(ROFFRULE_DENY == rr ? ROFF_IGN : ROFF_CONT);
898 	}
899 
900 	if (ep == st || (ep > st && '\\' != *(ep - 1)))
901 		roffnode_pop(r);
902 
903 	roffnode_cleanscope(r);
904 	return(ROFFRULE_DENY == rr ? ROFF_IGN : ROFF_CONT);
905 }
906 
907 
908 static enum roffrule
909 roff_evalcond(const char *v, int *pos)
910 {
911 
912 	switch (v[*pos]) {
913 	case ('n'):
914 		(*pos)++;
915 		return(ROFFRULE_ALLOW);
916 	case ('e'):
917 		/* FALLTHROUGH */
918 	case ('o'):
919 		/* FALLTHROUGH */
920 	case ('t'):
921 		(*pos)++;
922 		return(ROFFRULE_DENY);
923 	default:
924 		break;
925 	}
926 
927 	while (v[*pos] && ' ' != v[*pos])
928 		(*pos)++;
929 	return(ROFFRULE_DENY);
930 }
931 
932 /* ARGSUSED */
933 static enum rofferr
934 roff_line_ignore(ROFF_ARGS)
935 {
936 
937 	return(ROFF_IGN);
938 }
939 
940 /* ARGSUSED */
941 static enum rofferr
942 roff_line_error(ROFF_ARGS)
943 {
944 
945 	(*r->msg)(MANDOCERR_REQUEST, r->data, ln, ppos, roffs[tok].name);
946 	return(ROFF_IGN);
947 }
948 
949 /* ARGSUSED */
950 static enum rofferr
951 roff_cond(ROFF_ARGS)
952 {
953 	int		 sv;
954 	enum roffrule	 rule;
955 
956 	/* Stack overflow! */
957 
958 	if (ROFF_ie == tok && r->rstackpos == RSTACK_MAX - 1) {
959 		(*r->msg)(MANDOCERR_MEM, r->data, ln, ppos, NULL);
960 		return(ROFF_ERR);
961 	}
962 
963 	/* First, evaluate the conditional. */
964 
965 	if (ROFF_el == tok) {
966 		/*
967 		 * An `.el' will get the value of the current rstack
968 		 * entry set in prior `ie' calls or defaults to DENY.
969 	 	 */
970 		if (r->rstackpos < 0)
971 			rule = ROFFRULE_DENY;
972 		else
973 			rule = r->rstack[r->rstackpos];
974 	} else
975 		rule = roff_evalcond(*bufp, &pos);
976 
977 	sv = pos;
978 
979 	while (' ' == (*bufp)[pos])
980 		pos++;
981 
982 	/*
983 	 * Roff is weird.  If we have just white-space after the
984 	 * conditional, it's considered the BODY and we exit without
985 	 * really doing anything.  Warn about this.  It's probably
986 	 * wrong.
987 	 */
988 
989 	if ('\0' == (*bufp)[pos] && sv != pos) {
990 		(*r->msg)(MANDOCERR_NOARGS, r->data, ln, ppos, NULL);
991 		return(ROFF_IGN);
992 	}
993 
994 	roffnode_push(r, tok, NULL, ln, ppos);
995 
996 	r->last->rule = rule;
997 
998 	if (ROFF_ie == tok) {
999 		/*
1000 		 * An if-else will put the NEGATION of the current
1001 		 * evaluated conditional into the stack.
1002 		 */
1003 		r->rstackpos++;
1004 		if (ROFFRULE_DENY == r->last->rule)
1005 			r->rstack[r->rstackpos] = ROFFRULE_ALLOW;
1006 		else
1007 			r->rstack[r->rstackpos] = ROFFRULE_DENY;
1008 	}
1009 
1010 	/* If the parent has false as its rule, then so do we. */
1011 
1012 	if (r->last->parent && ROFFRULE_DENY == r->last->parent->rule)
1013 		r->last->rule = ROFFRULE_DENY;
1014 
1015 	/*
1016 	 * Determine scope.  If we're invoked with "\{" trailing the
1017 	 * conditional, then we're in a multiline scope.  Else our scope
1018 	 * expires on the next line.
1019 	 */
1020 
1021 	r->last->endspan = 1;
1022 
1023 	if ('\\' == (*bufp)[pos] && '{' == (*bufp)[pos + 1]) {
1024 		r->last->endspan = -1;
1025 		pos += 2;
1026 	}
1027 
1028 	/*
1029 	 * If there are no arguments on the line, the next-line scope is
1030 	 * assumed.
1031 	 */
1032 
1033 	if ('\0' == (*bufp)[pos])
1034 		return(ROFF_IGN);
1035 
1036 	/* Otherwise re-run the roff parser after recalculating. */
1037 
1038 	*offs = pos;
1039 	return(ROFF_RERUN);
1040 }
1041 
1042 
1043 /* ARGSUSED */
1044 static enum rofferr
1045 roff_ds(ROFF_ARGS)
1046 {
1047 	char		*name, *string;
1048 
1049 	/*
1050 	 * A symbol is named by the first word following the macro
1051 	 * invocation up to a space.  Its value is anything after the
1052 	 * name's trailing whitespace and optional double-quote.  Thus,
1053 	 *
1054 	 *  [.ds foo "bar  "     ]
1055 	 *
1056 	 * will have `bar  "     ' as its value.
1057 	 */
1058 
1059 	name = *bufp + pos;
1060 	if ('\0' == *name)
1061 		return(ROFF_IGN);
1062 
1063 	string = name;
1064 	/* Read until end of name. */
1065 	while (*string && ' ' != *string)
1066 		string++;
1067 
1068 	/* Nil-terminate name. */
1069 	if (*string)
1070 		*(string++) = '\0';
1071 
1072 	/* Read past spaces. */
1073 	while (*string && ' ' == *string)
1074 		string++;
1075 
1076 	/* Read passed initial double-quote. */
1077 	if (*string && '"' == *string)
1078 		string++;
1079 
1080 	/* The rest is the value. */
1081 	roff_setstr(r, name, string, 0);
1082 	return(ROFF_IGN);
1083 }
1084 
1085 
1086 /* ARGSUSED */
1087 static enum rofferr
1088 roff_nr(ROFF_ARGS)
1089 {
1090 	const char	*key, *val;
1091 	struct reg	*rg;
1092 
1093 	key = &(*bufp)[pos];
1094 	rg = r->regs->regs;
1095 
1096 	/* Parse register request. */
1097 	while ((*bufp)[pos] && ' ' != (*bufp)[pos])
1098 		pos++;
1099 
1100 	/*
1101 	 * Set our nil terminator.  Because this line is going to be
1102 	 * ignored anyway, we can munge it as we please.
1103 	 */
1104 	if ((*bufp)[pos])
1105 		(*bufp)[pos++] = '\0';
1106 
1107 	/* Skip whitespace to register token. */
1108 	while ((*bufp)[pos] && ' ' == (*bufp)[pos])
1109 		pos++;
1110 
1111 	val = &(*bufp)[pos];
1112 
1113 	/* Process register token. */
1114 
1115 	if (0 == strcmp(key, "nS")) {
1116 		rg[(int)REG_nS].set = 1;
1117 		if ( ! roff_parse_nat(val, &rg[(int)REG_nS].v.u))
1118 			rg[(int)REG_nS].v.u = 0;
1119 	}
1120 
1121 	return(ROFF_IGN);
1122 }
1123 
1124 /* ARGSUSED */
1125 static enum rofferr
1126 roff_TE(ROFF_ARGS)
1127 {
1128 
1129 	if (NULL == r->tbl)
1130 		(*r->msg)(MANDOCERR_NOSCOPE, r->data, ln, ppos, NULL);
1131 	else
1132 		tbl_end(r->tbl);
1133 
1134 	r->tbl = NULL;
1135 	return(ROFF_IGN);
1136 }
1137 
1138 /* ARGSUSED */
1139 static enum rofferr
1140 roff_T_(ROFF_ARGS)
1141 {
1142 
1143 	if (NULL == r->tbl)
1144 		(*r->msg)(MANDOCERR_NOSCOPE, r->data, ln, ppos, NULL);
1145 	else
1146 		tbl_restart(ppos, ln, r->tbl);
1147 
1148 	return(ROFF_IGN);
1149 }
1150 
1151 /* ARGSUSED */
1152 static enum rofferr
1153 roff_TS(ROFF_ARGS)
1154 {
1155 	struct tbl_node	*t;
1156 
1157 	if (r->tbl) {
1158 		(*r->msg)(MANDOCERR_SCOPEBROKEN, r->data, ln, ppos, NULL);
1159 		tbl_end(r->tbl);
1160 	}
1161 
1162 	t = tbl_alloc(ppos, ln, r->data, r->msg);
1163 
1164 	if (r->last_tbl)
1165 		r->last_tbl->next = t;
1166 	else
1167 		r->first_tbl = r->last_tbl = t;
1168 
1169 	r->tbl = r->last_tbl = t;
1170 	return(ROFF_IGN);
1171 }
1172 
1173 /* ARGSUSED */
1174 static enum rofferr
1175 roff_so(ROFF_ARGS)
1176 {
1177 	char *name;
1178 
1179 	(*r->msg)(MANDOCERR_SO, r->data, ln, ppos, NULL);
1180 
1181 	/*
1182 	 * Handle `so'.  Be EXTREMELY careful, as we shouldn't be
1183 	 * opening anything that's not in our cwd or anything beneath
1184 	 * it.  Thus, explicitly disallow traversing up the file-system
1185 	 * or using absolute paths.
1186 	 */
1187 
1188 	name = *bufp + pos;
1189 	if ('/' == *name || strstr(name, "../") || strstr(name, "/..")) {
1190 		(*r->msg)(MANDOCERR_SOPATH, r->data, ln, pos, NULL);
1191 		return(ROFF_ERR);
1192 	}
1193 
1194 	*offs = pos;
1195 	return(ROFF_SO);
1196 }
1197 
1198 /* ARGSUSED */
1199 static enum rofferr
1200 roff_userdef(ROFF_ARGS)
1201 {
1202 	const char	 *arg[9];
1203 	char		 *cp, *n1, *n2;
1204 	int		  i;
1205 
1206 	/*
1207 	 * Collect pointers to macro argument strings
1208 	 * and null-terminate them.
1209 	 */
1210 	cp = *bufp + pos;
1211 	for (i = 0; i < 9; i++)
1212 		arg[i] = '\0' == *cp ? "" :
1213 		    mandoc_getarg(&cp, r->msg, r->data, ln, &pos);
1214 
1215 	/*
1216 	 * Expand macro arguments.
1217 	 */
1218 	*szp = 0;
1219 	n1 = cp = mandoc_strdup(r->current_string);
1220 	while (NULL != (cp = strstr(cp, "\\$"))) {
1221 		i = cp[2] - '1';
1222 		if (0 > i || 8 < i) {
1223 			/* Not an argument invocation. */
1224 			cp += 2;
1225 			continue;
1226 		}
1227 
1228 		*szp = strlen(n1) - 3 + strlen(arg[i]) + 1;
1229 		n2 = mandoc_malloc(*szp);
1230 
1231 		strlcpy(n2, n1, (size_t)(cp - n1 + 1));
1232 		strlcat(n2, arg[i], *szp);
1233 		strlcat(n2, cp + 3, *szp);
1234 
1235 		cp = n2 + (cp - n1);
1236 		free(n1);
1237 		n1 = n2;
1238 	}
1239 
1240 	/*
1241 	 * Replace the macro invocation
1242 	 * by the expanded macro.
1243 	 */
1244 	free(*bufp);
1245 	*bufp = n1;
1246 	if (0 == *szp)
1247 		*szp = strlen(*bufp) + 1;
1248 
1249 	return(*szp > 1 && '\n' == (*bufp)[(int)*szp - 2] ?
1250 	   ROFF_REPARSE : ROFF_APPEND);
1251 }
1252 
1253 /*
1254  * Store *string into the user-defined string called *name.
1255  * In multiline mode, append to an existing entry and append '\n';
1256  * else replace the existing entry, if there is one.
1257  * To clear an existing entry, call with (*r, *name, NULL, 0).
1258  */
1259 static void
1260 roff_setstr(struct roff *r, const char *name, const char *string,
1261 	int multiline)
1262 {
1263 	struct roffstr	 *n;
1264 	char		 *c;
1265 	size_t		  oldch, newch;
1266 
1267 	/* Search for an existing string with the same name. */
1268 	n = r->first_string;
1269 	while (n && strcmp(name, n->name))
1270 		n = n->next;
1271 
1272 	if (NULL == n) {
1273 		/* Create a new string table entry. */
1274 		n = mandoc_malloc(sizeof(struct roffstr));
1275 		n->name = mandoc_strdup(name);
1276 		n->string = NULL;
1277 		n->next = r->first_string;
1278 		r->first_string = n;
1279 	} else if (0 == multiline) {
1280 		/* In multiline mode, append; else replace. */
1281 		free(n->string);
1282 		n->string = NULL;
1283 	}
1284 
1285 	if (NULL == string)
1286 		return;
1287 
1288 	/*
1289 	 * One additional byte for the '\n' in multiline mode,
1290 	 * and one for the terminating '\0'.
1291 	 */
1292 	newch = strlen(string) + (multiline ? 2 : 1);
1293 	if (NULL == n->string) {
1294 		n->string = mandoc_malloc(newch);
1295 		*n->string = '\0';
1296 		oldch = 0;
1297 	} else {
1298 		oldch = strlen(n->string);
1299 		n->string = mandoc_realloc(n->string, oldch + newch);
1300 	}
1301 
1302 	/* Skip existing content in the destination buffer. */
1303 	c = n->string + oldch;
1304 
1305 	/* Append new content to the destination buffer. */
1306 	while (*string) {
1307 		/*
1308 		 * Rudimentary roff copy mode:
1309 		 * Handle escaped backslashes.
1310 		 */
1311 		if ('\\' == *string && '\\' == *(string + 1))
1312 			string++;
1313 		*c++ = *string++;
1314 	}
1315 
1316 	/* Append terminating bytes. */
1317 	if (multiline)
1318 		*c++ = '\n';
1319 	*c = '\0';
1320 }
1321 
1322 
1323 static const char *
1324 roff_getstrn(const struct roff *r, const char *name, size_t len)
1325 {
1326 	const struct roffstr *n;
1327 
1328 	n = r->first_string;
1329 	while (n && (strncmp(name, n->name, len) || '\0' != n->name[(int)len]))
1330 		n = n->next;
1331 
1332 	return(n ? n->string : NULL);
1333 }
1334 
1335 
1336 static void
1337 roff_freestr(struct roff *r)
1338 {
1339 	struct roffstr	 *n, *nn;
1340 
1341 	for (n = r->first_string; n; n = nn) {
1342 		free(n->name);
1343 		free(n->string);
1344 		nn = n->next;
1345 		free(n);
1346 	}
1347 
1348 	r->first_string = NULL;
1349 }
1350 
1351 const struct tbl_span *
1352 roff_span(const struct roff *r)
1353 {
1354 
1355 	return(r->tbl ? tbl_span(r->tbl) : NULL);
1356 }
1357