Bugfix:

When after a \\, \t, or \a, another \t or \a had to be resolved
in copy mode within the same argument, the argument got corrupted.
Found while working on a loosely related bug report
from Fabio Scotoni <fabio at esse dot ch>.

4 files changed, 9 insertions, 4 deletions

diff --git a/regress/char/space/esct-man.in b/regress/char/space/esct-man.in
index f290d9e2..5b886958 100644
--- a/regress/char/space/esct-man.in
+++ b/regress/char/space/esct-man.in
@@ -1,5 +1,5 @@
-.\" $OpenBSD: esct-man.in,v 1.2 2017/07/04 14:53:23 schwarze Exp $
-.TH SPACE-ESCT-MAN 1 "December 15, 2018"
+.\" $OpenBSD: esct-man.in,v 1.4 2018/12/20 03:38:10 schwarze Exp $
+.TH SPACE-ESCT-MAN 1 "December 20, 2018"
 .SH NAME
 SPACE-T-MAN \- the t escape sequence in pages with man macros
 .SH DESCRIPTION
@@ -45,3 +45,5 @@ After font macros:
 .\" XXX not implemented
 .\" .br
 .\" .B single\aleader
+.br
+.B double\t\ttab
diff --git a/regress/char/space/esct-man.out_ascii b/regress/char/space/esct-man.out_ascii
index 3056cc72..89e41917 100644
--- a/regress/char/space/esct-man.out_ascii
+++ b/regress/char/space/esct-man.out_ascii
@@ -34,7 +34,8 @@ DDEESSCCRRIIPPTTIIOONN
 
        After font macros:
        ssiinnggllee    ttaabb
+       ddoouubbllee         ttaabb
 
 
 
-OpenBSD                        December 15, 2018             SPACE-ESCT-MAN(1)
+OpenBSD                        December 20, 2018             SPACE-ESCT-MAN(1)
diff --git a/regress/char/space/esct-man.out_lint b/regress/char/space/esct-man.out_lint
index 2fa8ba9c..f94f50bb 100644
--- a/regress/char/space/esct-man.out_lint
+++ b/regress/char/space/esct-man.out_lint
@@ -4,3 +4,5 @@ mandoc: esct-man.in:14:8: WARNING: tab in filled text
 mandoc: esct-man.in:34:11: WARNING: tab in filled text
 mandoc: esct-man.in:36:11: WARNING: tab in filled text
 mandoc: esct-man.in:44:10: WARNING: tab in filled text
+mandoc: esct-man.in:49:10: WARNING: tab in filled text
+mandoc: esct-man.in:49:11: WARNING: tab in filled text
diff --git a/roff.c b/roff.c
index be4a0a1c..2d83f452 100644
--- a/roff.c
+++ b/roff.c
@@ -1588,7 +1588,7 @@ mandoc_getarg(char **cpp, int ln, int *pos)
 			switch (cp[1]) {
 			case 'a':
 			case 't':
-				cp[0] = '\t';
+				cp[-pairs] = '\t';
 				/* FALLTHROUGH */
 			case '\\':
 				pairs++;