Bug#735673: nvi: large tabstop causes segmentation fault

[Kusanagi Kouichi <slash@ac.auone-net.jp>]

Package: nvi
Version: 1.81.6-11
Severity: normal
Tags: patch

Steps to reproduce:

1. Open the attached text file with nvi
2. Set tabstop to a large number. For example, :set tabstop=1000
3. Scroll forward by control-f
4. Scroll backward by control-b

The attached patch fixed the segmentation fault. But I don't know if
this is proper fix.

-- System Information:
Debian Release: jessie/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 3.13.0-rc7 (SMP w/4 CPU cores)
Locale: LANG=ja_JP.eucJP, LC_CTYPE=ja_JP.eucJP (charmap=EUC-JP)
Shell: /bin/sh linked to /bin/dash

Versions of packages nvi depends on:
ii  libc6         2.17-97
ii  libdb5.1      5.1.29-7
ii  libncursesw5  5.9+20131221-1
ii  libtinfo5     5.9+20131221-1

Versions of packages nvi recommends:
pn  nvi-doc  <none>

nvi suggests no packages.

-- no debconf information

	1








































































































































































































--- nvi-1.81.6/vi/vs_line.c	2014-01-17 10:07:35.196857991 +0000
+++ nvi-1.81.6.orig/vi/vs_line.c	2007-11-18 16:41:42.000000000 +0000
@@ -442,11 +442,8 @@
 				*cbp++ = ch;
 			} else
 				for (kp = KEY_NAME(sp, ch) + offset_in_char; 
-				     chlen--;) {
-					if (cbp >= ecbp)
-						FLUSH;
+				     chlen--;)
 					*cbp++ = (u_char)*kp++;
-				}
 		}
 	}