From owner-freebsd-bugs  Thu Mar 13 10:47:52 1997
Return-Path: <owner-bugs>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.5/8.8.5) id KAA13813
          for bugs-outgoing; Thu, 13 Mar 1997 10:47:52 -0800 (PST)
Received: from mauve.csi.cam.ac.uk (exim@mauve.csi.cam.ac.uk [131.111.8.38])
          by freefall.freebsd.org (8.8.5/8.8.5) with SMTP id KAA13803
          for <freebsd-bugs@freebsd.org>; Thu, 13 Mar 1997 10:47:44 -0800 (PST)
Received: from g.pet.cam.ac.uk [131.111.209.233] 
	by mauve.csi.cam.ac.uk with smtp (Exim 1.58 #1)
	id 0w5FXL-0000xp-00; Thu, 13 Mar 1997 18:47:35 +0000
Received: from g.pet.cam.ac.uk [127.0.0.1] 
	by g.pet.cam.ac.uk with esmtp (Exim 1.59 #1)
	id 0w5FXd-0005de-00; Thu, 13 Mar 1997 18:47:53 +0000
To: freebsd-bugs@freebsd.org
Subject: Re: bin/2968: fmt dumps core on ^M 
In-reply-to: Your message of "Thu, 13 Mar 1997 01:11:26 +0100."
             <199703130011.BAA04027@ghost.mep.ruhr-uni-bochum.de> 
Date: Thu, 13 Mar 1997 18:47:53 +0000
From: Gareth McCaughan <gjm11@dpmms.cam.ac.uk>
Message-Id: <E0w5FXd-0005de-00@g.pet.cam.ac.uk>
Sender: owner-bugs@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

Robert Eckardt wrote:

> 	fmt experiences Bus error when one tries to format
> 	a text that contains ^M (CRs), i.e. e.g. from an
> 	MSDOS system.

Actually, that's not quite true. I think it only happens if you
invoke it with a file whose first line contains only non-printing
characters.

The problem is caused by the fact that, when a line of this kind is
seen, the |canonb| pointer may not get initialised; as a consequence
the loop
    for (cp2--; cp2 >= canonb && *cp2 == ' '; cp2--)
(before the start of which |cp2==canonb| in this situation) loses
because pointers are compared as if they're unsigned.

I believe the following patch fixes the problem. It certainly
looks OK and repairs the test cases I've tried.

---------- patch begins ----------
*** fmt.c.orig	Thu Mar 13 10:57:48 1997
--- fmt.c	Thu Mar 13 18:43:13 1997
***************
*** 147,153 ****
  	register char *cp, *cp2, cc;
  	register int c, col;
  #define CHUNKSIZE 1024
! 	static int lbufsize = 0, cbufsize = 0;
  
  	if (center) {
  		linebuf = malloc(BUFSIZ);
--- 147,157 ----
  	register char *cp, *cp2, cc;
  	register int c, col;
  #define CHUNKSIZE 1024
! 	static int lbufsize = 0, cbufsize = CHUNKSIZE;
! 
! 	canonb = malloc(CHUNKSIZE);
! 	if (canonb == 0)
! 		abort();
  
  	if (center) {
  		linebuf = malloc(BUFSIZ);
----------- patch ends -----------

-- 
Gareth McCaughan       Dept. of Pure Mathematics & Mathematical Statistics,
gjm11@dpmms.cam.ac.uk  Cambridge University, England.