From owner-freebsd-bugs  Fri Mar  1 00:59:06 1996
Return-Path: owner-bugs
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.3/8.7.3) id AAA26902
          for bugs-outgoing; Fri, 1 Mar 1996 00:59:06 -0800 (PST)
Received: from mail.cs.tu-berlin.de (root@mail.cs.tu-berlin.de [130.149.17.13])
          by freefall.freebsd.org (8.7.3/8.7.3) with ESMTP id AAA26822
          for <bugs@FreeBSD.ORG>; Fri, 1 Mar 1996 00:56:44 -0800 (PST)
Received: from ole.cs.tu-berlin.de (wosch@ole.cs.tu-berlin.de [130.149.22.3]) by mail.cs.tu-berlin.de (8.6.12/8.6.12) with ESMTP id JAA28376; Fri, 1 Mar 1996 09:55:23 +0100
From: Wolfram Schneider <wosch@cs.tu-berlin.de>
Received: (wosch@localhost) by ole.cs.tu-berlin.de (8.6.12/8.6.6) id JAA25172; Fri, 1 Mar 1996 09:55:22 +0100
Date: Fri, 1 Mar 1996 09:55:22 +0100
Message-Id: <199603010855.JAA25172@ole.cs.tu-berlin.de>
To: batie@agora.rdrop.com (Alan Batie), bugs@FreeBSD.ORG
Subject: Re: vi core dump
In-Reply-To: <199602290335.EAA01570@campa.panke.de>
References: <m0trptJ-000AoBC@agora.rdrop.com>
	<199602290335.EAA01570@campa.panke.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
Content-Conversion: prohibited
Sender: owner-bugs@FreeBSD.ORG
Precedence: bulk

Wolfram Schneider writes:
>In article <m0trptJ-000AoBC@agora.rdrop.com> batie@agora.rdrop.com (Alan Batie) writes:
>
>>The following sequence will cause vi to core dump:
>>
>>    vi
>>    0 5 * * * ~ba
>
>or '~a', '~i'
>
>Fix:

Argh! You need also fix the line number.

--- vi/v_ulcase.c	1996/03/01 09:33:31	1.1
+++ vi/v_ulcase.c	1996/03/01 09:39:21
@@ -84,6 +84,7 @@
 	u_long cnt;
 	char *p;
 
+	len = 0;
 	lno = vp->m_start.lno;
 	cno = vp->m_start.cno;
 
@@ -120,7 +121,10 @@
 
 	/* Check to see if we tried to move past EOF. */
 	if (file_gline(sp, ep, vp->m_final.lno, &len) == NULL) {
-		(void)file_gline(sp, ep, --vp->m_final.lno, &len);
+		/* line number start with 1, lno zero is illegal */
+		if (vp->m_final.lno > 1)
+			--vp->m_final.lno;
+		(void)file_gline(sp, ep, vp->m_final.lno, &len);
 		vp->m_final.cno = len == 0 ? 0 : len - 1;
 	}
 	return (0);