[Nano-devel] justify segfault unmasked

[David Lawrence Ramsey]

I've finally reproduced the justification segfault, and traced through
it.  The problem is in do_justify() itself.  It can be reproduced as
follows:

1. Open the first attached file in nano, and turn smooth scrolling on.

2. Using the down arrow, move down to the magicline.

3. Hit the up arrow once.  You should now be at the beginning of "line
20".

4. Press Enter to insert a blank line between "line 19" and "line 20".

5. Hit the up arrow twice.  You should now be at the beginning of "line
19".

6. Hit ^J.  Segfault.

According to my trace with gdb, the segfault itself is caused by
update_line()'s assuming that edittop is set to a sane value when it
actually points to garbage.  The root of the problem is in line 2468 of
nano.c.  The first time nano reaches that line, edittop is fine; the
second time, current->next (i. e. line) and edittop are both pointing to
the same location, so when line is deleted (and unlinked beforehand), so
is edittop.

I've made an attempt at fixing it, and it appears to work in my
preliminary tests, but I'm not entirely sure; it's the second attached
file.


_____________________________________________________________
Sluggy.Net: The Sluggy Freelance Community!

_____________________________________________________________
Select your own custom email address for FREE! Get address@hidden w/No Ads, 
6MB, POP & more! http://www.everyone.net/selectmail?campaign=tag

line 1
line 2
line 3
line 4
line 5
line 6
line 7
line 8
line 9
line 10
line 11
line 12
line 13
line 14
line 15
line 16
line 17
line 18
line 19
line 20

nanojustifysegv.patch
Description: Binary data