bin/58813: Incorrect behavour of sed(1)

[Tim Robbins]

Kris Kennaway wrote:

>Synopsis: Incorrect behavour of sed(1)
>
>Responsible-Changed-From-To: freebsd-bugs->tjr
>Responsible-Changed-By: kris
>Responsible-Changed-When: Sat Nov 1 16:57:45 PST 2003
>Responsible-Changed-Why: 
>tjr has done a lot of work on sed, perhaps he will be interested
>in fixing this.
>
>http://www.freebsd.org/cgi/query-pr.cgi?pr=58813
>  
>
Please try the attached patch. It fixes a buffer management bug that was 
causing heap corruption. The patch is against -current, but it should 
apply cleanly to 4.9.
(http://perforce.freebsd.org/chv.cgi?CH=41082)


Tim
-------------- next part --------------
--- process.c.old	Sun Nov  2 14:27:26 2003
+++ process.c	Sun Nov  2 14:24:28 2003
@@ -557,7 +557,8 @@
 	char c, *dst;
 
 #define	NEEDSP(reqlen)							\
-	if (sp->len >= sp->blen - (reqlen) - 1) {			\
+	/* XXX What is the +1 for? */					\
+	if (sp->len + (reqlen) + 1 >= sp->blen) {			\
 		sp->blen += (reqlen) + 1024;				\
 		if ((sp->space = sp->back = realloc(sp->back, sp->blen)) \
 		    == NULL)						\