Package: joe
Version: 3.7-1
Severity: important
Tags: patch

If called with more than one file, joe
crashes with a segfault in main.c, line 434:
  p_goto_bol(bw->cursor);

The segfault is caused by BW *bw getting reinitialized to
NULL on every iteration of the for() loop starting in line 405,
except on the first file, where bw is set in line 426.
The correct place to define BW *bw is thus outside the for() loop.

-- System Information:
Debian Release: squeeze/sid
  APT prefers testing
  APT policy: (500, 'testing'), (500, 'stable')
Architecture: i386 (i686)

Kernel: Linux 2.6.33-smp (SMP w/4 CPU cores)
Locale: LANG=C, LC_CTYPE=da_DK (charmap=ISO-8859-1)
Shell: /bin/sh linked to /bin/dash

Versions of packages joe depends on:
ii  libc6                     2.10.2-6       Embedded GNU C Library: Shared lib
ii  libncurses5               5.7+20100313-2 shared libraries for terminal hand

joe recommends no packages.

joe suggests no packages.

-- Configuration Files:
/etc/joe/ftyperc changed [not included]

-- no debconf information
--- joe-3.7.org/main.c  2008-10-27 04:01:11.000000000 +0100
+++ joe-3.7/main.c      2010-03-14 13:21:00.000000000 +0100
@@ -154,6 +154,7 @@

 int main(int argc, char **real_argv, char **envv)
 {
+	BW *bw = NULL;
 	CAP *cap;
 	unsigned char **argv = (unsigned char **)real_argv;
 	struct stat sbuf;
@@ -412,7 +413,6 @@
 				++c;
 		} else {
 			B *b = bfind(argv[c]);
-			BW *bw = NULL;
 			int er = berror;

 			/* This is too annoying */

Reply via email to