bin/46615: vi(1) dumps core when paging around with large tabstop sizes

[cyber%netbsd.org@localhost]

>Number:         46615
>Category:       bin
>Synopsis:       vi(1) dumps core when paging around with large tabstop sizes
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Jun 19 04:40:00 +0000 2012
>Originator:     Erik Berls
>Release:        5.1.2 amd64
>Organization:
NetBSD
>Environment:
NetBSD builder 5.1.2 NetBSD 5.1.2 (GENERIC) #0: Thu Feb  2 12:12:28 UTC 2012  
builds%b7.netbsd.org@localhost:/home/builds/ab/netbsd-5-1-2-RELEASE/amd64/201202021012Z-obj/home/builds/ab/netbsd-5-1-2-RELEASE/src/sys/arch/amd64/compile/GENERIC
 amd64

>Description:
When setting tabstops (ts=) to large values vi will dump core when paging into 
(or back up) from areas with multiple tabs.

Program terminated with signal 11, Segmentation fault.
#0  0x0000000000408c1b in default_char2int ()
(gdb) bt
#0  0x0000000000408c1b in default_char2int ()
#1  0x000000000040906a in fe_char2int ()
#2  0x000000000040a458 in db_get ()
#3  0x00000000004404e5 in vs_line ()
#4  0x0000000000442bdf in vs_paint ()
#5  0x000000000044374b in vs_paint ()
#6  0x000000000044374b in vs_paint ()
[stack loops back on itself]


>How-To-Repeat:
1. create a file with enough blank lines to scroll past the bottom of the page. 
after that point, add several lines that contain tabs. (My test file had 56 
lines, then 18 tabs over the course of 14 lines. Some with multiple, others 
with none.)
2. save file and reopen
3. "set ts=1024"
4. page down (ctrl-f) and then back up (ctrl-b)
5. repeat (4) until core.

>Fix: