From 923bf6b6b20172d100e1515ad7a4f93d3a4b233e Mon Sep 17 00:00:00 2001
From: Ingo Schwarze <schwarze@openbsd.org>
Date: Thu, 20 Dec 2018 03:41:54 +0000
Subject: Bugfix: When after a \\, \t, or \a, another \t or \a had to be
 resolved in copy mode within the same argument, the argument got corrupted.
 Found while working on a loosely related bug report from Fabio Scotoni <fabio
 at esse dot ch>.

---
 roff.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'roff.c')

diff --git a/roff.c b/roff.c
index e25a74ef..0304156f 100644
--- a/roff.c
+++ b/roff.c
@@ -1,4 +1,4 @@
-/*	$Id: roff.c,v 1.353 2018/12/18 22:00:02 schwarze Exp $ */
+/*	$Id: roff.c,v 1.354 2018/12/20 03:41:54 schwarze Exp $ */
 /*
  * Copyright (c) 2008-2012, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010-2015, 2017, 2018 Ingo Schwarze <schwarze@openbsd.org>
@@ -1588,7 +1588,7 @@ mandoc_getarg(char **cpp, int ln, int *pos)
 			switch (cp[1]) {
 			case 'a':
 			case 't':
-				cp[0] = '\t';
+				cp[-pairs] = '\t';
 				/* FALLTHROUGH */
 			case '\\':
 				pairs++;
-- 
cgit v1.2.3