[src/trunk]: src/external/bsd/nvi/dist Fix segmentation fault in corner case ...

[rin <rin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/bbbce7a9545b
branches:  trunk
changeset: 828011:bbbce7a9545b
user:      rin <rin%NetBSD.org@localhost>
date:      Wed Nov 22 12:47:30 2017 +0000

description:
Fix segmentation fault in corner case of backward sentence deletion,
taken from nvi2 (and Debian Bug report #193498):
https://github.com/lichray/nvi2/commit/e84d40ec20b257edad6810062204366ff0ddff58
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=193498

diffstat:

 external/bsd/nvi/dist/common/delete.c |  22 ++++++++++++----------
 external/bsd/nvi/dist/vi/v_sentence.c |   6 +++---
 2 files changed, 15 insertions(+), 13 deletions(-)

diffs (70 lines):

diff -r 1e8f2faab405 -r bbbce7a9545b external/bsd/nvi/dist/common/delete.c
--- a/external/bsd/nvi/dist/common/delete.c     Wed Nov 22 10:19:14 2017 +0000
+++ b/external/bsd/nvi/dist/common/delete.c     Wed Nov 22 12:47:30 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: delete.c,v 1.3 2014/01/26 21:43:45 christos Exp $ */
+/*     $NetBSD: delete.c,v 1.4 2017/11/22 12:47:30 rin Exp $ */
 /*-
  * Copyright (c) 1992, 1993, 1994
  *     The Regents of the University of California.  All rights reserved.
@@ -16,7 +16,7 @@
 static const char sccsid[] = "Id: delete.c,v 10.17 2001/06/25 15:19:09 skimo Exp  (Berkeley) Date: 2001/06/25 15:19:09 ";
 #endif /* not lint */
 #else
-__RCSID("$NetBSD: delete.c,v 1.3 2014/01/26 21:43:45 christos Exp $");
+__RCSID("$NetBSD: delete.c,v 1.4 2017/11/22 12:47:30 rin Exp $");
 #endif
 
 #include <sys/types.h>
@@ -95,14 +95,16 @@
        if (tm->lno == fm->lno) {
                if (db_get(sp, fm->lno, DBG_FATAL, &p, &len))
                        return (1);
-               GET_SPACE_RETW(sp, bp, blen, len);
-               if (fm->cno != 0)
-                       MEMCPYW(bp, p, fm->cno);
-               MEMCPYW(bp + fm->cno, p + (tm->cno + 1), 
-                       len - (tm->cno + 1));
-               if (db_set(sp, fm->lno,
-                   bp, len - ((tm->cno - fm->cno) + 1)))
-                       goto err;
+               if (len != 0) {
+                       GET_SPACE_RETW(sp, bp, blen, len);
+                       if (fm->cno != 0)
+                               MEMCPYW(bp, p, fm->cno);
+                       MEMCPYW(bp + fm->cno, p + (tm->cno + 1), 
+                               len - (tm->cno + 1));
+                       if (db_set(sp, fm->lno,
+                           bp, len - ((tm->cno - fm->cno) + 1)))
+                               goto err;
+               }
                goto done;
        }
 
diff -r 1e8f2faab405 -r bbbce7a9545b external/bsd/nvi/dist/vi/v_sentence.c
--- a/external/bsd/nvi/dist/vi/v_sentence.c     Wed Nov 22 10:19:14 2017 +0000
+++ b/external/bsd/nvi/dist/vi/v_sentence.c     Wed Nov 22 12:47:30 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: v_sentence.c,v 1.3 2014/01/26 21:43:45 christos Exp $ */
+/*     $NetBSD: v_sentence.c,v 1.4 2017/11/22 12:47:30 rin Exp $ */
 /*-
  * Copyright (c) 1992, 1993, 1994
  *     The Regents of the University of California.  All rights reserved.
@@ -16,7 +16,7 @@
 static const char sccsid[] = "Id: v_sentence.c,v 10.9 2001/06/25 15:19:35 skimo Exp  (Berkeley) Date: 2001/06/25 15:19:35 ";
 #endif /* not lint */
 #else
-__RCSID("$NetBSD: v_sentence.c,v 1.3 2014/01/26 21:43:45 christos Exp $");
+__RCSID("$NetBSD: v_sentence.c,v 1.4 2017/11/22 12:47:30 rin Exp $");
 #endif
 
 #include <sys/types.h>
@@ -297,7 +297,7 @@
                         * we can end up where we started.  Fix it.
                         */
                        if (vp->m_start.lno != cs.cs_lno ||
-                           vp->m_start.cno != cs.cs_cno)
+                           vp->m_start.cno > cs.cs_cno)
                                goto okret;
 
                        /*