Package: nvi
Version: 1.81.6-4
Tags: patch
Severity: important
^A handling is broken; it doesn't generate [[:>:]] in the end of
resulting pattern, so e.g. after
cat >a <<EOF
a
aa
a
EOF
vi a
we hit ^A, we'll end up on the second line and not the third one.
Next ^A will end up looking for [[:<:]]aa, making behaviour even
more unpleasant.
The cause is simple - v_searchw() tries to concatenate the right
things, but it mistakes the allocation size of buffer that holds
the word we are on for the length of that word. So we get tons of
junk (including terminating NUL) *before* the appended [[:>:]].
Thankfully, regcomp stops at the first NUL, so at least the junk
doesn't get picked, but neither does [[:>:]]...
Severity set to important since
a) we have a silent breakage of editor command
b) more than interactive use is affected; it can occur in
user's macros and results of the breakage in those can be rather
destructive and hard to debug.
Fix is obvious:
--- nvi-1.81.6/vi/v_search.c 2007-11-18 11:41:42.000000000 -0500
+++ nvi-1.81.6.fix/vi/v_search.c 2009-03-05 15:37:37.000000000 -0500
@@ -322,16 +322,22 @@
v_searchw(SCR *sp, VICMD *vp)
{
size_t blen, len;
+ size_t olen;
int rval;
CHAR_T *bp, *p;
- len = VIP(sp)->klen + RE_WSTART_LEN + RE_WSTOP_LEN;
+ for (olen = 0; olen < VIP(sp)->klen; olen++)
+ if (!VIP(sp)->keyw[olen])
+ break;
+
+ len = olen + RE_WSTART_LEN + RE_WSTOP_LEN + 1;
GET_SPACE_RETW(sp, bp, blen, len);
MEMCPY(bp, RE_WSTART, RE_WSTART_LEN);
p = bp + RE_WSTART_LEN;
- MEMCPY(p, VIP(sp)->keyw, VIP(sp)->klen);
- p += VIP(sp)->klen;
+ MEMCPY(p, VIP(sp)->keyw, olen);
+ p += olen;
MEMCPY(p, RE_WSTOP, RE_WSTOP_LEN);
+ p[RE_WSTOP_LEN] = '\0';
rval = v_search(sp, vp, bp, len, SEARCH_SET, FORWARD);
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
