Hi,

So to test HEAD (accidentally--I was supposed to be testing 1.12.4-rc1 
but ran from the wrong directory), I wrote a little script to run 
through all the manuals on my system with mandoc via valgrind.  It has 
only found one nit on ALL of them.  On a binary file, at that!

Invalid read of size 1
    at 0x100017CC4: term_word (term.c:421)
    by 0x10000F4A1: print_man_node (man_term.c:974)
    by 0x10000F38C: print_man_nodelist (man_term.c:1042)
    by 0x10000F3BC: print_man_nodelist (man_term.c:1045)
    by 0x10000F3BC: print_man_nodelist (man_term.c:1045)
    by 0x10000F3BC: print_man_nodelist (man_term.c:1045)
    by 0x10000F3BC: print_man_nodelist (man_term.c:1045)
    by 0x10000F3BC: print_man_nodelist (man_term.c:1045)
    by 0x10000F3BC: print_man_nodelist (man_term.c:1045)
    by 0x10000F3BC: print_man_nodelist (man_term.c:1045)
    by 0x10000F3BC: print_man_nodelist (man_term.c:1045)
    by 0x10000F3BC: print_man_nodelist (man_term.c:1045)
  Address 0x100082e12 is 0 bytes after a block of size 306 alloc'd
    at 0xC658: malloc (vg_replace_malloc.c:295)
    by 0x28E358: strdup (in /usr/lib/system/libsystem_c.dylib)
    by 0x100046164: mandoc_strdup (mandoc_aux.c:102)
    by 0x10003D89B: roff_strdup (roff.c:2233)
    by 0x100025636: man_word_alloc (man.c:308)
    by 0x100024E26: man_ptext (man.c:449)
    by 0x100024316: man_parseln (man.c:126)
    by 0x100047F1D: mparse_buf_r (read.c:562)
    by 0x10004665C: mparse_parse_buffer (read.c:718)
    by 0x1000467A3: mparse_readfd (read.c:764)
    by 0x10001E2C4: parse (main.c:308)
    by 0x10001DA08: main (main.c:244)

I tracked this down to passing "\H<nil>" to mandoc_escape().  It seems 
we're not very careful in this function to receiving \0 after the 
initial marker, so enclosed are some check.  I may have missed some, so 
please pass a critical eye over this as well!

Thoughts?

Best,

Kristaps