From: Anders Helmersson <anders.helmersson.utsikt@wasadata.net>
Date: Sun, 7 Aug 2005 06:20:37 +0000 (+0000)
Subject: Certain versions of libc may segfault during regex processing if given
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ea29bff34a558520554f566ac03830390500e3bb;p=neomutt

Certain versions of libc may segfault during regex processing if given
incomplete multibyte characters. Work around this by manually trimming
the display buffer. I modified it somewhat to only check when the
situation is most likely to occur: fgets has read all the way to the
capacity of the buffer. Thanks also to Tamo for his comments.
---

diff --git a/pager.c b/pager.c
index 898f380fc..e40d34ce7 100644
--- a/pager.c
+++ b/pager.c
@@ -969,13 +969,34 @@ static int grok_ansi(unsigned char *buf, int pos, ansi_attr *a)
   return pos;
 }
 
+/* trim tail of buf so that it contains complete multibyte characters */
+static int
+trim_incomplete_mbyte(unsigned char *buf, size_t len)
+{
+  mbstate_t mbstate;
+  size_t k;
+
+  memset (&mbstate, 0, sizeof (mbstate));
+  for (; len > 0; buf += k, len -= k)
+  {
+    k = mbrtowc (NULL, (char *) buf, len, &mbstate);
+    if (k == -2) 
+      break; 
+    else if (k == -1 || k == 0) 
+      k = 1;
+  }
+  *buf = '\0';
+
+  return len;
+}
+
 static int
 fill_buffer (FILE *f, long *last_pos, long offset, unsigned char *buf, 
 	     unsigned char *fmt, size_t blen, int *buf_ready)
 {
   unsigned char *p;
   static int b_read;
-
+  
   if (*buf_ready == 0)
   {
     buf[blen - 1] = 0;
@@ -990,6 +1011,11 @@ fill_buffer (FILE *f, long *last_pos, long offset, unsigned char *buf,
     b_read = (int) (*last_pos - offset);
     *buf_ready = 1;
 
+    /* incomplete mbyte characters trigger a segfault in regex processing for
+     * certain versions of glibc. Trim them if necessary. */
+    if (b_read == blen - 2)
+      b_read -= trim_incomplete_mbyte(buf, b_read);
+    
     /* copy "buf" to "fmt", but without bold and underline controls */
     p = buf;
     while (*p)