3 files changed, 11 insertions, 4 deletions
diff --git a/chars.c b/chars.c
index 98d436fe..72da5103 100644
--- a/chars.c
+++ b/chars.c
@@ -141,6 +141,7 @@ mchars_res2cp(struct mchars *arg, const char *p, size_t sz)
  * This can only be a printable character (i.e., alnum, punct, space) so
  * prevent the character from ruining our state (backspace, newline, and
  * so on).
+ * If the character is illegal, returns '\0'.
  */
 char
 mchars_num2char(const char *p, size_t sz)
diff --git a/html.c b/html.c
index 199fd0c9..2b0d588a 100644
--- a/html.c
+++ b/html.c
@@ -316,9 +316,10 @@ html_strlen(const char *cp)
 		switch (mandoc_escape(&cp, &seq, &ssz)) {
 		case (ESCAPE_ERROR):
 			return(sz);
+		case (ESCAPE_NUMBERED):
+			/* FALLTHROUGH */
 		case (ESCAPE_PREDEF):
-			sz++;
-			break;
+			/* FALLTHROUGH */
 		case (ESCAPE_SPECIAL):
 			sz++;
 			break;
diff --git a/term.c b/term.c
index 7f21d8b7..66b78ed4 100644
--- a/term.c
+++ b/term.c
@@ -605,7 +605,7 @@ size_t
 term_strlen(const struct termp *p, const char *cp)
 {
 	size_t		 sz, rsz, i;
-	int		 ssz;
+	int		 ssz, c;
 	const char	*seq, *rhs;
 	static const char rej[] = { '\\', ASCII_HYPH, ASCII_NBRSP, '\0' };
 
@@ -624,9 +624,15 @@ term_strlen(const struct termp *p, const char *cp)
 		switch (*cp) {
 		case ('\\'):
 			cp++;
+			rhs = NULL;
 			switch (mandoc_escape(&cp, &seq, &ssz)) {
 			case (ESCAPE_ERROR):
 				return(sz);
+			case (ESCAPE_NUMBERED):
+				c = mchars_num2char(seq, ssz);
+				if ('\0' != c)
+					sz += (*p->width)(p, c);
+				break;
 			case (ESCAPE_PREDEF):
 				rhs = mchars_res2str
 					(p->symtab, seq, ssz, &rsz);
@@ -642,7 +648,6 @@ term_strlen(const struct termp *p, const char *cp)
 				rsz = ssz;
 				break;
 			default:
-				rhs = NULL;
 				break;
 			}