tac: avoid segfault for e.g., "echo > x; tac -r x x"

* src/tac.c (tac_seekable): Move local "regs" declaration out
to file scope, so its values aren't clobbered between calls.
Discovered by Cristian Cadar, Daniel Dunbar and Dawson Engler,
reported in http://thread.gmane.org/gmane.comp.gnu.coreutils.bugs/13501
* NEWS: Mention the bug fix.
* tests/Makefile.am (TESTS): Add misc/tac.
* tests/misc/tac: New file.  Test for the above.

4 files changed, 50 insertions, 1 deletions

diff --git a/NEWS b/NEWS
index faf2b1d76..d7ec1b2f1 100644
--- a/NEWS
+++ b/NEWS
@@ -13,6 +13,9 @@ GNU coreutils NEWS                                    -*- outline -*-
   Printing of such large-numbered, kernel-only (not in /etc/group) group-IDs
   was suppressed in 6.11 due to ignorance that they are useful.
 
+  tac: avoid segfault with --regex (-r) and multiple files, e.g.,
+  "echo > x; tac -r x x".  [bug present at least in textutils-1.8b, from 1992]
+
 
 * Noteworthy changes in release 6.11 (2008-04-19) [stable]
 
diff --git a/src/tac.c b/src/tac.c
index 262bf875e..e9ba10d73 100644
--- a/src/tac.c
+++ b/src/tac.c
@@ -110,6 +110,7 @@ static size_t G_buffer_size;
 /* The compiled regular expression representing `separator'. */
 static struct re_pattern_buffer compiled_separator;
 static char compiled_separator_fastmap[UCHAR_MAX + 1];
+static struct re_registers regs;
 
 static struct option const longopts[] =
 {
@@ -212,7 +213,6 @@ tac_seekable (int input_fd, const char *file)
   char first_char = *separator;	/* Speed optimization, non-regexp. */
   char const *separator1 = separator + 1; /* Speed optimization, non-regexp. */
   size_t match_length1 = match_length - 1; /* Speed optimization, non-regexp. */
-  struct re_registers regs;
 
   /* Find the size of the input file. */
   file_pos = lseek (input_fd, (off_t) 0, SEEK_END);
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 8dde07e8c..343d71948 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -203,6 +203,7 @@ TESTS =						\
   misc/stty-row-col				\
   misc/sum					\
   misc/sum-sysv					\
+  misc/tac					\
   misc/tac-continue				\
   misc/tee					\
   misc/tee-dash					\
diff --git a/tests/misc/tac b/tests/misc/tac
new file mode 100644
index 000000000..208791a4a
--- /dev/null
+++ b/tests/misc/tac
@@ -0,0 +1,45 @@
+#!/bin/sh
+# -*- perl -*-
+
+# Copyright (C) 2008 Free Software Foundation, Inc.
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+: ${top_srcdir=../..}
+. $top_srcdir/tests/require-perl
+
+me=`echo $0|sed 's,.*/,,'`
+exec $PERL -w -I$top_srcdir/tests -MCoreutils -M"CuTmpdir qw($me)" -- - <<\EOF
+require 5.003;
+use strict;
+
+my $prog = 'tac';
+
+# Turn off localization of executable's output.
+@ENV{qw(LANGUAGE LANG LC_ALL)} = ('C') x 3;
+
+my @Tests =
+(
+  ['segfault', '-r', {IN=>"a\n"}, {IN=>"b\n"}, {OUT=>"a\nb\n"}],
+  ['segfault2','-r', {IN=>"a\nb\n"}, {IN=>"1\n2\n"}, {OUT=>"b\na\n2\n1\n"}],
+);
+
+# @Tests = triple_test \@Tests;
+
+my $save_temps = $ENV{DEBUG};
+my $verbose = $ENV{VERBOSE};
+
+my $fail = run_tests ($prog, $prog, \@Tests, $save_temps, $verbose);
+exit $fail;
+EOF