The command `echo a|./fmt -2147483647' would cause fmt to segfault.

(fmt_paragraph): Test for sentinal directly, rather than
doing arithmetic with it's potentially large (INT_MAX) length.

1 files changed, 8 insertions, 0 deletions

diff --git a/src/fmt.c b/src/fmt.c
index 85b347f9a..c7427dba4 100644
--- a/src/fmt.c
+++ b/src/fmt.c
@@ -816,6 +816,14 @@ fmt_paragraph (void)
 	      start->next_break = w;
 	      start->line_length = len;
 	    }
+
+	  /* This is a kludge to keep us from computing `len' as the
+	     sum of the sentinel length and some non-zero number.
+	     Since the sentinel w->length may be INT_MAX, adding
+	     to that would give a negative result.  */
+	  if (w == word_limit)
+	    break;
+
 	  len += (w - 1)->space + w->length;	/* w > start >= word */
 	}
       while (len < max_width);