lib/59945: nvi coredump in libcurses

["Simon Burge via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         59945
>Category:       lib
>Synopsis:       nvi coredump in libcurses
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    lib-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jan 26 14:20:00 +0000 2026
>Originator:     Simon Burge
>Release:        NetBSD 11.99.4 - sources from 31 Dec 2025.
>Organization:
No, not really.
>Environment:
System: NetBSD thoreau.thistledown.com.au 11.99.4 NetBSD 11.99.4 (THOREAU.git) #74: Wed Dec 31 21:53:25 AEDT 2025 simonb%thoreau.thistledown.com.au@localhost:/NetBSD/netbsd-zfsboot-git/sys/arch/amd64/compile/THOREAU amd64
Architecture: x86_64
Machine: amd64
>Description:
        nvi gets a segmentation fault in libcurses when you follow the
        steps in "how to repeat" section.  This segfault happens with
        screen when the terminal type is "screen".  If you set the
        terminal type to "xterm" it works normally.

        This happens on multiple 10.x amd64 systems, but same recipe works
        fine on a 9.2 amd64 system.


	$ gdb /usr/bin/vi vi.core

	Reading symbols from /usr/bin/vi...
	[New process 28239]
	Core was generated by `vi'.
	Program terminated with signal SIGSEGV, Segmentation fault.
	#0  0x00007e9809724eb2 in putchbr (nsp=0x7e98091387e0, csp=0x7e980916a2a0, psp=0x0,
	    wy=59, wx=89) at /NetBSD/netbsd-zfsboot-git/lib/libcurses/refresh.c:1089
	1089            pcw = psp->wcols;
	(gdb) bt
	#0  0x00007e9809724eb2 in putchbr (nsp=0x7e98091387e0, csp=0x7e980916a2a0, psp=0x0,
	    wy=59, wx=89) at /NetBSD/netbsd-zfsboot-git/lib/libcurses/refresh.c:1089
	#1  makech (wy=<optimized out>)
	    at /NetBSD/netbsd-zfsboot-git/lib/libcurses/refresh.c:1419
	#2  doupdate () at /NetBSD/netbsd-zfsboot-git/lib/libcurses/refresh.c:720
	#3  0x000000000021a9fd in cl_refresh (sp=0x7e98091ef000, repaint=0)
	    at /NetBSD/src/external/bsd/nvi/dist/cl/cl_funcs.c:647
	#4  0x0000000000257adc in vs_paint (sp=sp@entry=0x7e98091ef000, flags=<optimized out>)
	    at /NetBSD/src/external/bsd/nvi/dist/vi/vs_refresh.c:777
	#5  0x0000000000258be2 in vs_refresh (sp=sp@entry=0x7e98091ef000,
	    forcepaint=forcepaint@entry=0)
	    at /NetBSD/src/external/bsd/nvi/dist/vi/vs_refresh.c:99
	#6  0x00000000002538d3 in vi (spp=spp@entry=0x7f7fff9633e0)
	    at /NetBSD/src/external/bsd/nvi/dist/vi/vi.c:115
	#7  0x000000000023b173 in editor (wp=wp@entry=0x7e980924a000, argc=<optimized out>,
	    argc@entry=2, argv=<optimized out>, argv@entry=0x7f7fff963678)
	    at /NetBSD/src/external/bsd/nvi/dist/common/main.c:436
	#8  0x00000000002668a7 in main (argc=2, argv=0x7f7fff963678)
	    at /NetBSD/src/external/bsd/nvi/dist/cl/cl_main.c:134

>How-To-Repeat:
	In a screen session:
	run: vi `stty -a | awk '/ columns;/ { printf "%*s", $6 - 24, " "}' | tr ' ' x`
	type:  :w <enter> <enter> :w <enter>
>Fix:
	Yes please!