Reject the escape sequences \[uD800] to \[uDFFF] in the parser.

These surrogates are not valid Unicode codepoints,
so treat them just like any other undefined character escapes:
Warn about them and do not produce output.
Issue noticed while talking to stsp@, semarie@, and bentley@.

1 files changed, 3 insertions, 0 deletions

diff --git a/mandoc.c b/mandoc.c
index 203d0858..275575cb 100644
--- a/mandoc.c
+++ b/mandoc.c
@@ -333,6 +333,9 @@ mandoc_escape(const char **end, const char **start, int *sz)
 			break;
 		if (*sz == 6 && (*start)[1] == '0')
 			break;
+		if (*sz == 5 && (*start)[1] == 'D' &&
+		    strchr("89ABCDEF", (*start)[2]) != NULL)
+			break;
 		if ((int)strspn(*start + 1, "0123456789ABCDEFabcdef")
 		    + 1 == *sz)
 			gly = ESCAPE_UNICODE;