pr -e, with a mix of backspaces and TABs, could corrupt the heap

* tests/pr/Test.pm: New tests for the above.
* src/pr.c (char_to_clump): Ensure that "input_position" never
goes below 0.
Also, elide any backspace encountered when input_position is 0,
to be compatible at least with /bin/pr from Solaris 10.
This bug is present in the original version:
b25038ce9a234ea0906ddcbd8a0012e917e6c661
* NEWS [Bug fixes]: Mention this.
Report and diagnosis by Cristian Cadar, Daniel Dunbar and Dawson Engler
in http://thread.gmane.org/gmane.comp.gnu.coreutils.bugs/13272

1 files changed, 11 insertions, 1 deletions

diff --git a/src/pr.c b/src/pr.c
index 77d4c8ae7..14c9d22a1 100644
--- a/src/pr.c
+++ b/src/pr.c
@@ -2726,7 +2726,17 @@ char_to_clump (char c)
       *s = c;
     }
 
-  input_position += width;
+  /* Too many backspaces must put us in position 0 -- never negative.  */
+  if (width < 0 && input_position == 0)
+    {
+      chars = 0;
+      input_position = 0;
+    }
+  else if (width < 0 && input_position <= -width)
+    input_position = 0;
+  else
+    input_position += width;
+
   return chars;
 }