core dump in texinfo 4.1 and 4.2 found by shrinking window height

[Danny Yoo]

Hello!  I've found a core dumping situation with the 'info' utility: while
changing the size of my terminal window, I accidently shrank the window
too small.  To my surprise, info segfaults!

Here is the backtrace:

###
Program received signal SIGSEGV, Segmentation fault.
display_update_one_window (win=0x8067fc8) at display.c:237
237               if (entry->inverse
(gdb) bt
#0  display_update_one_window (win=0x8067fc8) at display.c:237
#1  0x08049de5 in display_update_display (window=0x8067fc8) at
display.c:85
#2  0x0805a894 in redisplay_after_signal () at signals.c:101
#3  0x0805aadb in info_signal_handler (sig=28) at signals.c:199
#4  <signal handler called>
#5  0x420dad92 in read () from /lib/i686/libc.so.6
(gdb) print entry
$1 = (DISPLAY_LINE *) 0x0
###


Because I shrank my screen so small vertically, there weren't any visible
entries on screen, so 'entry' is pointed to NULL.  This is the source
of the segfault.


The fix is to double check that 'entry' exists before following the
reference:

    if (entry && entry->inverse



This bug appears to affect texinfo 4.1 and 4.2.  Here's my patch:




address@hidden tmp]$ diff -u texinfo-4.2/info/display.c
/home/dyoo/downloads/texinfo-4.2/info/display.c
--- texinfo-4.2/info/display.c  Fri Mar  8 13:41:47 2002
+++ /home/dyoo/downloads/texinfo-4.2/info/display.c     Mon Jul  8
15:11:57 2002@@ -234,7 +234,7 @@

           /* If the screen line is inversed, then we have to clear
              the line from the screen first.  Why, I don't know. */
-          if (entry->inverse
+          if (entry && entry->inverse
              /* Need to erase the line if it has escape sequences.  */
              || (raw_escapes_p && strchr (entry->text, '\033') != 0))
             {




I hope this helps!



Sincerely,
Danny Yoo