RCS log gets up to large numbers of revisions then RCS will core dump

[haoming chu]

RCS has a known bug which when an RCS log gets up to large numbers of 
revisions then RCS will core dump. We have seen this when the RCS log 
gets upwards of 80-90,000 entries. RCS will continue to core dump on any 
command(co,ci) until the log file is truncated, which is the only 
workaround for this issue. The only time we have seen this is in an 
error state from a program which is updating a file consistently over 
time due to a bug.

for example:

In rcs-5.7-37.el6.x86_64.rpm in CentOS 6.5

# ci -l ./ifcfg-bond3
./RCS/ifcfg-bond3,v <-- ./ifcfg-bond3
Segmentation fault (core dumped)

We found that root cause is:

Infinite recursion without cut-off conditions was used in function 
'puttree' in 'rcsgen.c'(line: 553).

So stack collapsed when too many entries in rcs log file.
(ifcfg-bond3,v in attach.tar.gz).

void
puttree(root, fout)
struct hshentry const *root;
register FILE *fout;
/* Output the delta tree with base ROOT in preorder to FOUT. */
{
struct branchhead const *nextbranch;

if (!root) return;

if (root->selector)
putdelta(root, fout);

puttree(root->next, fout);

nextbranch = root->branches;
while (nextbranch) {
puttree(nextbranch->hsh, fout);
nextbranch = nextbranch->nextbranch;
}
}

We make a patch (rcs-5.7-37.patch) to workround this problem in
rcs-5.7-37.el6.x86_64.

(Replace recursion with iteration of the loop.)

rcs-5.7-37.patch
Description: Text document

attach.tar.gz
Description: application/gzip