BUG in info command

[Andreas Herrmann]

Hi,

Recently I tried to use info on a RedHat 7.3 system (info (GNU
texinfo) 4.2).  And it crashed with SIGSEGV.  Setting MALLOC_CHECK_=2
info aborted. So obviously usage of malloc/free was somewhat
erroneous.

I downloaded texinfo-4.2.tar.gz for debugging. Unfortunately I didn't
got a SIGSEGV anymore. But using MALLOC_CHECK_=2 it aborted again.  I
determined the following error: In function replace_in_documentation()
determination of length for repstr (which is allocated later on) is
false in case argstr is empty.  Later on strcat() is called, but
repstr is then too short to concatenate rep to it.

See below patch to fix the bug.


Regards,

Andreas


diff -Naur texinfo-4.2/info/infodoc.c texinfo-4.2-new/info/infodoc.c
--- texinfo-4.2/info/infodoc.c      Wed Feb 27 13:37:33 2002
+++ texinfo-4.2-new/info/infodoc.c  Mon Aug 19 15:47:55 2002
@@ -1006,7 +1006,7 @@
            rep = command ? where_is (info_keymap, command) : NULL;
            if (!rep)
              rep = "N/A";
-           replen = (argstr ? strlen (argstr) + 1 : 0) + strlen (rep);
+           replen = (argstr ? strlen (argstr) : 0) + strlen (rep) + 1;
            repstr = (char *)xmalloc (replen);
            repstr[0] = '\0';
            if (argstr)