Re: off by one in vi(1)

2013-05-14 Thread Todd C. Miller
On Sun, 12 May 2013 20:57:50 +0300, Arto Jonsson wrote: > Thanks for the review. Here's an updated diff. If anyone's curious this > bug is about one month short of being 20 years old. Committed, thanks. - todd

Re: off by one in vi(1)

2013-05-12 Thread Arto Jonsson
On Sat, May 11, 2013 at 05:33:20PM -0600, Todd C. Miller wrote: > Good catch, I know folks who have hit this bug but I was never able > to reproduce it. Moving the isblank() check should be safe since > trailing blanks are trimmed earlier on so we won't exit the loop > prematurely. I see you didn

Re: off by one in vi(1)

2013-05-11 Thread Todd C. Miller
On Tue, 07 May 2013 19:10:44 +0300, Arto Jonsson wrote: > While writing an email vi(1) crashed with segmentation fault. > > When ^W (WERASE) is hit in insert mode it's possible that the line > buffer is accessed out of bounds. If 'max' == 0 and 'tp->cno' == 1 the > 'tp->cno' value is first reduce