Fix two issues with .po (page offset) formatting:

1. Truncate excessive offsets to a width reasonable in the context
of manual pages instead of printing excessively long lines
and sometimes causing assertion failures;
found in an afl run performed by Jan Schreiber <jes at posteo dot de>.
2. Remember both the requested and the applied page offset; otherwise,
subtracting an excessive width, then adding it again, would end up
with an incorrectly large offset.
While here, simplify the code by reverting the previous offset up front,
and also add some comments to make the general ideas easier to understand.

4 files changed, 66 insertions, 7 deletions

diff --git a/regress/roff/po/Makefile b/regress/roff/po/Makefile
index dabc7c9e..fa2f5774 100644
--- a/regress/roff/po/Makefile
+++ b/regress/roff/po/Makefile
@@ -1,5 +1,13 @@
-# $OpenBSD: Makefile,v 1.1 2017/05/08 15:33:43 schwarze Exp $
+# $OpenBSD: Makefile,v 1.2 2020/09/03 20:33:20 schwarze Exp $
 
-REGRESS_TARGETS	= basic-mdoc
+REGRESS_TARGETS	= basic-mdoc range
+
+# groff-1.22.4 defect:
+# - Negative page objects sometimes result in output lines starting
+#   with backspace characters.
+# - Excessive page offsets cause excessive line lengths
+#   instead of being truncated to resonable widths.
+
+SKIP_GROFF	 = range
 
 .include <bsd.regress.mk>
diff --git a/regress/roff/po/range.in b/regress/roff/po/range.in
new file mode 100644
index 00000000..4cfadc7a
--- /dev/null
+++ b/regress/roff/po/range.in
@@ -0,0 +1,24 @@
+.\" $OpenBSD: range.in,v 1.1 2020/09/03 20:33:20 schwarze Exp $
+.Dd $Mdocdate$
+.Dt PO-RANGE 1
+.Os
+.Sh NAME
+.Nm po-range
+.Nd page offsets out of range
+.Sh DESCRIPTION
+initial text
+.Pp
+.po -10n
+too small
+.Pp
+.po +10n
+back in range
+.Pp
+.po 80n
+too large
+.Pp
+.po -70n
+back in range
+.Pp
+.po 0
+final text
diff --git a/regress/roff/po/range.out_ascii b/regress/roff/po/range.out_ascii
new file mode 100644
index 00000000..cc55df27
--- /dev/null
+++ b/regress/roff/po/range.out_ascii
@@ -0,0 +1,19 @@
+PO-RANGE(1)                 General Commands Manual                PO-RANGE(1)
+
+NNAAMMEE
+     ppoo--rraannggee - page offsets out of range
+
+DDEESSCCRRIIPPTTIIOONN
+     initial text
+
+too small
+
+     back in range
+
+                                                                 too large
+
+               back in range
+
+     final text
+
+OpenBSD                        September 3, 2020                       OpenBSD
diff --git a/roff_term.c b/roff_term.c
index ff71dc35..7f5058a4 100644
--- a/roff_term.c
+++ b/roff_term.c
@@ -1,6 +1,6 @@
-/* $Id$ */
+/* $OpenBSD: roff_term.c,v 1.20 2020/09/03 17:37:06 schwarze Exp $ */
 /*
- * Copyright (c) 2010,2014,2015,2017-2019 Ingo Schwarze <schwarze@openbsd.org>
+ * Copyright (c) 2010,2014,2015,2017-2020 Ingo Schwarze <schwarze@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -157,9 +157,13 @@ static void
 roff_term_pre_po(ROFF_TERM_ARGS)
 {
 	struct roffsu	 su;
-	static int	 po, polast;
+	static int	 po, pouse, polast;
 	int		 ponew;
 
+	/* Revert the currently active page offset. */
+	p->tcol->offset -= pouse;
+
+	/* Determine the requested page offset. */
 	if (n->child != NULL &&
 	    a2roffsu(n->child->string, &su, SCALE_EM) != NULL) {
 		ponew = term_hen(p, &su);
@@ -168,11 +172,15 @@ roff_term_pre_po(ROFF_TERM_ARGS)
 			ponew += po;
 	} else
 		ponew = polast;
+
+	/* Remeber both the previous and the newly requested offset. */
 	polast = po;
 	po = ponew;
 
-	ponew = po - polast + (int)p->tcol->offset;
-	p->tcol->offset = ponew > 0 ? ponew : 0;
+	/* Truncate to the range [-offset, 60], remember, and apply it. */
+	pouse = po >= 60 ? 60 :
+	    po < -(int)p->tcol->offset ? -p->tcol->offset : po;
+	p->tcol->offset += pouse;
 }
 
 static void