diff options
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | src/pr.c | 12 | ||||
| -rw-r--r-- | tests/pr/Test.pm | 12 |
3 files changed, 25 insertions, 2 deletions
@@ -42,6 +42,9 @@ GNU coreutils NEWS -*- outline -*- "paste -d'\' file" no longer overruns memory (heap since coreutils-5.1.2, stack before then) [bug present in the original version, in 1992] + "pr -e" with a mix of backspaces and TABs no longer corrupts the heap + [bug present in the original version, in 1992] + "ptx -F'\' long-file-name" would overrun a malloc'd buffer and corrupt the heap. That was triggered by a lone backslash (or odd number of them) at the end of the option argument to --flag-truncation=STRING (-F), @@ -2726,7 +2726,17 @@ char_to_clump (char c) *s = c; } - input_position += width; + /* Too many backspaces must put us in position 0 -- never negative. */ + if (width < 0 && input_position == 0) + { + chars = 0; + input_position = 0; + } + else if (width < 0 && input_position <= -width) + input_position = 0; + else + input_position += width; + return chars; } diff --git a/tests/pr/Test.pm b/tests/pr/Test.pm index 0bbad457f..5dea41690 100644 --- a/tests/pr/Test.pm +++ b/tests/pr/Test.pm @@ -1,6 +1,6 @@ # -*-perl-*- -# Copyright (C) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2004, 2005, 2007 +# Copyright (C) 1996-2002, 2004, 2005, 2007-2008 # Free Software Foundation, Inc. # This program is free software: you can redistribute it and/or modify @@ -373,6 +373,16 @@ my @tv = ( # Before coreutils-5.3.1, --pages=1:-1 would be treated like # --pages=1:18446744073709551615. ['neg-page', '--pages=1:-1', '', '', 1], + +# Up to coreutils-6.10, this would cause pr to decrement its +# internal "input_position" below zero and sometimes segfault. +['neg-inp-pos1', '-t -e', "\b\b\b\b\b\b\tx\n", " x\n", 0], +# NB: while there are 4 backspaces in the input, there are only 3 in the output +['neg-inp-pos2', '-t -e', "abc\b\b\b\b\tx", "abc\b\b\b x\n", 0], + +# This would clobber so much of the heap, it'd segfault or abort every time. +['smash-heap', '-t -e300', "a".("\b"x50)."\t", "a\b".(" "x300)."\n", 0], +['smash-heap8', '-t -e', "a".("\b"x50)."\t", "a\b".(" "x 8)."\n", 0], ); #']]); |