 @@ -63,27 +63,28 @@ void	 	 man_free(struct man *);
 struct	man	*man_alloc(struct roff *, struct mparse *);
 void		 man_reset(struct man *);
 int	 	 man_parseln(struct man *, int, char *, int);
 int		 man_endparse(struct man *);
 int		 man_addspan(struct man *, const struct tbl_span *);
 int		 man_addeqn(struct man *, const struct eqn *);
 void	 	 roff_free(struct roff *);
 struct roff	*roff_alloc(struct mparse *);
 void		 roff_reset(struct roff *);
 enum rofferr	 roff_parseln(struct roff *, int,
 			char **, size_t *, int, int *);
 void		 roff_endparse(struct roff *);
-size_t		 roff_expand_nr(struct roff *, const char *, char *, size_t);
+void		 roff_expand_nr(struct roff *, const char *, int *, size_t,
 		    char **, int *, size_t *);
 int		 roff_regisset(const struct roff *, enum regs);
 unsigned int	 roff_regget(const struct roff *, enum regs);
 void		 roff_regunset(struct roff *, enum regs);
 char		*roff_strdup(const struct roff *, const char *);
 #if 0
 char		 roff_eqndelim(const struct roff *);
 void		 roff_openeqn(struct roff *, const char *,
 			int, int, const char *);
 int		 roff_closeeqn(struct roff *);
 #endif
 const struct tbl_span	*roff_span(const struct roff *);
 const struct eqn	*roff_eqn(const struct roff *);

 @@ -344,39 +344,28 @@ mparse_buf_r(struct mparse *curp, struct
 				continue;
+			}
 			/* Trailing backslash = a plain char. */
 			if ('\\' != blk.buf[i] || i + 1 == (int)blk.sz) {
 				if (pos >= (int)ln.sz)
 					resize_buf(&ln, 256);
 				ln.buf[pos++] = blk.buf[i++];
 				continue;
+			}
 			if ('\\' == blk.buf[i] && 'n' == blk.buf[i + 1]) {
-				int j, k;
+				roff_expand_nr(curp->roff,
-				i += 2;
+				    blk.buf, &i, blk.sz, &ln.buf, &pos, &ln.sz);
 				if ('(' == blk.buf[i]) /* ) */
 					i++;
 				resize_buf(&ln, 256);
 				for (j = i, k = pos; i < j + 256
 				    && i < (int)blk.sz
 				    && !isspace((unsigned char)blk.buf[i]);)
 				    ln.buf[k++] = blk.buf[i++];
 				ln.buf[k] = '\0';
 				pos += roff_expand_nr(curp->roff,
 				    ln.buf + pos, ln.buf + pos, 256);
+			}
 			/*
 			 * Found escape and at least one other character.
 			 * When it's a newline character, skip it.
 			 * When there is a carriage return in between,
 			 * skip that one as well.
 			 */
 			if ('\r' == blk.buf[i + 1] && i + 2 < (int)blk.sz &&
 			    '\n' == blk.buf[i + 2])
 				++i;
 			if ('\n' == blk.buf[i + 1]) {

 @@ -167,26 +167,28 @@ static	void		 roffhash_init(void);
 static	void		 roffnode_cleanscope(struct roff *);
 static	void		 roffnode_pop(struct roff *);
 static	void		 roffnode_push(struct roff *, enum rofft,
 				const char *, int, int);
 static	enum rofferr	 roff_block(ROFF_ARGS);
 static	enum rofferr	 roff_block_text(ROFF_ARGS);
 static	enum rofferr	 roff_block_sub(ROFF_ARGS);
 static	enum rofferr	 roff_cblock(ROFF_ARGS);
 static	enum rofferr	 roff_ccond(ROFF_ARGS);
 static	enum rofferr	 roff_cond(ROFF_ARGS);
 static	enum rofferr	 roff_cond_text(ROFF_ARGS);
 static	enum rofferr	 roff_cond_sub(ROFF_ARGS);
 static	enum rofferr	 roff_ds(ROFF_ARGS);
 static  void		 roff_expand_nr_inplace(struct roff *, char **, int *,
 				size_t *);
 static	enum roffrule	 roff_evalcond(const char *, int *);
 static	void		 roff_free1(struct roff *);
 static	void		 roff_freestr(struct roffkv *);
 static	char		*roff_getname(struct roff *, char **, int, int);
 static	const char	*roff_getstrn(const struct roff *,
 				const char *, size_t);
 static	enum rofferr	 roff_line_ignore(ROFF_ARGS);
 static	enum rofferr	 roff_nr(ROFF_ARGS);
 static	void		 roff_openeqn(struct roff *, const char *,
 				int, int, const char *);
 static	enum rofft	 roff_parse(struct roff *, const char *, int *);
 static	enum rofferr	 roff_parsetext(char *);
 static	enum rofferr	 roff_res(struct roff *,
 @@ -1043,26 +1045,32 @@ roff_cond_sub(ROFF_ARGS)
 /* ARGSUSED */
 static enum rofferr
 roff_cond_text(ROFF_ARGS)
+{
 	char		*ep;
 	enum roffrule	 rr;
 	rr = r->last->rule;
 	roffnode_cleanscope(r);
 	ep = &(*bufp)[pos];
 	for ( ; NULL != (ep = strchr(ep, '\\')); ep++) {
 		ep++;
 		if (*ep == 'n') {
 			int i = ep - *bufp - 1;
 			roff_expand_nr_inplace(r, bufp, &i, szp);
 			ep = *bufp + i;
 			continue;
+		}
 		if ('}' != *ep)
 			continue;
 		*ep = '&';
 		roff_ccond(r, ROFF_ccond, bufp, szp,
 				ln, pos, pos + 2, offs);
+	}
 	return(ROFFRULE_DENY == rr ? ROFF_IGN : ROFF_CONT);
+}
 static enum roffrule
 roff_evalcond(const char *v, int *pos)
+{
 @@ -1298,37 +1306,96 @@ roff_nr(ROFF_ARGS)
 	h->val = mandoc_strntoi(val, strlen(val), 10);
 	if (0 == strcmp(key, "nS")) {
 		r->regs[(int)REG_nS].set = 1;
 		if (h->val >= 0)
 			r->regs[(int)REG_nS].u = (unsigned)h->val;
 		else
 			r->regs[(int)REG_nS].u = 0u;
+	}
 	return(ROFF_IGN);
+}
-size_t
+void
-roff_expand_nr(struct roff *r, const char *key, char *lp, size_t lpl)
+roff_expand_nr(struct roff *r, const char *src, int *sp, size_t slen,
     char **dst, int *dp, size_t *dlenp)
+{
 	uint32_t	 hv;
 	struct roff_nr	*h;
 	int		 l, s, d;
 	char		 e, *key;
-	if ((h = hash_find(r, key, &hv)) == NULL)
+	s = *sp + 2;	/* skip \\\n */
-		return 0;
+	d = *dp;
 	if ('[' == src[s]) {		/* XXX: Support builtins */
 		s++;
 		e = ']';
 	} else
 		e = '\0';
 	for (l = s; l < (int)slen; l++) {
 		if (e) {
 			if (src[l] == e)
 				break;
 		} else {
 			if (isspace((unsigned char)src[l]))
 				break;
+		}
+	}
 	*sp = l;
 	l -= s;
 	key = mandoc_malloc(l + 1);
 	memcpy(key, src + s, l);
 	key[l] = '\0';
 	if ((h = hash_find(r, key, &hv)) == NULL) {
 		free(key);
 		return;
+	}
 	if (*dst == NULL || *dlenp - *dp < 256)
 		*dst = mandoc_realloc(*dst, *dlenp += 256);
 	/* XXX: support .af */
-	return snprintf(lp, lpl, "%jd", h->val);
+	*dp += snprintf(*dst + *dp, *dlenp - *dp, "%jd", h->val);
+}
 static void
 roff_expand_nr_inplace(struct roff *r, char **src, int *sp, size_t *slenp)
+{
 	int j, i, k;
 	size_t dlen;
 	char *dst;
 	k = i = *sp;
 	dst = NULL;
 	j = 0;
 	dlen = 0;
 	roff_expand_nr(r, *src, &i, *slenp, &dst, &j, &dlen);
 	if (j) {
 		int l = j - (i - k);
 		if (l > 0) {
 			*slenp += l;
 			*src = mandoc_realloc(*src, *slenp);
+		}
 		memmove(*src + j + k, *src + i, *slenp - i);
 		memcpy(*src + k, dst, j);
 		free(dst);
+	}
 	*sp = k + j;
+}
 /* ARGSUSED */
 static enum rofferr
 roff_rm(ROFF_ARGS)
+{
 	const char	 *name;
 	char		 *cp;
 	cp = *bufp + pos;
 	while ('\0' != *cp) {
 		name = roff_getname(r, &cp, ln, (int)(cp - *bufp));
 		if ('\0' != *name)