Re: off by one in vi(1)

2013-05-14 Thread Todd C. Miller
On Sun, 12 May 2013 20:57:50 +0300, Arto Jonsson wrote: Thanks for the review. Here's an updated diff. If anyone's curious this bug is about one month short of being 20 years old. Committed, thanks. - todd

Re: off by one in vi(1)

2013-05-12 Thread Arto Jonsson
On Sat, May 11, 2013 at 05:33:20PM -0600, Todd C. Miller wrote: Good catch, I know folks who have hit this bug but I was never able to reproduce it. Moving the isblank() check should be safe since trailing blanks are trimmed earlier on so we won't exit the loop prematurely. I see you didn't

Re: off by one in vi(1)

2013-05-11 Thread Todd C. Miller
On Tue, 07 May 2013 19:10:44 +0300, Arto Jonsson wrote: While writing an email vi(1) crashed with segmentation fault. When ^W (WERASE) is hit in insert mode it's possible that the line buffer is accessed out of bounds. If 'max' == 0 and 'tp-cno' == 1 the 'tp-cno' value is first reduced by