Hi, Fuzzing sed with afl, I found a crash due to use of uninitialized variable.
In process.c oldpsl variable need to be initialized: $ echo | sed -e 'g;P' Segmentation fault (core dumped) The following patch correct this. I also include the initialization of p, as it is reported by compiler warning too (with -Wall -O2). Thanks. -- Sébastien Marie Index: process.c =================================================================== RCS file: /cvs/src/usr.bin/sed/process.c,v retrieving revision 1.20 diff -u -p -r1.20 process.c --- process.c 1 Dec 2014 06:37:25 -0000 1.20 +++ process.c 10 Dec 2014 09:15:15 -0000 @@ -83,8 +83,8 @@ process(void) { struct s_command *cp; SPACE tspace; - size_t len, oldpsl; - char *p; + size_t len, oldpsl = 0; + char *p = NULL; for (linenum = 0; mf_fgets(&PS, REPLACE);) {