[joe] - Resolves: #663503 memory corruption problem in wrapword function

[Ivana Varekova]

commit d4ad7abf334d6503d84d679aec21d37e1348e17d
Author: Ivana Hutarova Varekova <varekova at redhat.com>
Date:   Mon Jan 3 13:08:55 2011 +0100

    - Resolves: #663503
      memory corruption problem in wrapword function

 joe-3.7-indent-ow.patch |   74 +++++++++++++++++++++++++++++++++++++++++++++++
 joe.spec                |    8 ++++-
 2 files changed, 81 insertions(+), 1 deletions(-)
---
diff --git a/joe-3.7-indent-ow.patch b/joe-3.7-indent-ow.patch
new file mode 100644
index 0000000..5358f42
--- /dev/null
+++ b/joe-3.7-indent-ow.patch
@@ -0,0 +1,74 @@
+diff -up joe-3.7/uformat.c.pom joe-3.7/uformat.c
+--- joe-3.7/uformat.c.pom	2008-10-28 05:13:56.000000000 +0100
++++ joe-3.7/uformat.c	2011-01-03 12:58:53.000000000 +0100
+@@ -330,6 +330,7 @@ void wrapword(BW *bw, P *p, long int ind
+ 	int c;
+ 	long to = p->byte;
+ 	int my_indents = 0;
++	off_t indents_size = 0;
+ 	
+ 	/* autoindent when called by utype */
+ 	if (!indents) {
+@@ -347,7 +348,8 @@ void wrapword(BW *bw, P *p, long int ind
+ 
+ 			indent = nindent(bw, q, 0);
+ 			pcol(r, indent);
+-			indents = brs(q, r->byte - q->byte);
++			indents_size = r->byte - q->byte;
++			indents = brs(q, indents_size);
+ 			prm(r);
+ 		} else {
+ 			/* First line */
+@@ -356,14 +358,15 @@ void wrapword(BW *bw, P *p, long int ind
+ 
+ 			indent = nindent(bw, s, 1);
+ 			pcol(r, indent);
+-			indents = brs(s, r->byte - s->byte);
++			indents_size = r->byte - s->byte;
++			indents = brs(s, indents_size);
+ 			prm(r);
+ 			if (!bw->o.autoindent) {
+ 				/* Don't indent second line of single-line paragraphs if autoindent is off */
+ 				int x = zlen(indents);
+ 				while (x && (indents[x - 1] == ' ' || indents[x - 1] == '\t'))
+ 					indents[--x] = 0;
+-				if (x) {
++				if ((x) && (x < indents_size)) {
+ 					indents[x++] = ' ';
+ 					indents[x] = 0;
+ 				}
+@@ -522,6 +525,7 @@ int uformat(BW *bw)
+ 	long curoff;
+ 	int c;
+ 	P *p, *q;
++	off_t indents_size = 0;
+ 
+ 	p = pdup(bw->cursor, USTR "uformat");
+ 	p_goto_bol(p);
+@@ -552,21 +556,23 @@ int uformat(BW *bw)
+ 
+ 		indent = nindent(bw, q, 0);
+ 		pcol(r, indent);
+-		indents = brs(q, r->byte - q->byte);
++		indents_size = r->byte - q->byte;
++		indents = brs(q, indents_size);
+ 		prm(r);
+ 	} else {
+ 		P *r = pdup(p, USTR "uformat");
+ 		int x, y;
+ 		indent = nindent(bw, p, 1); /* allowing * and - here */
+ 		pcol(r, indent);
+-		indents = brs(p, r->byte - p->byte);
++		indents_size = r->byte - p->byte;
++		indents = brs(p, indents_size);
+ 		prm(r);
+ 		if (!bw->o.autoindent) {
+ 			/* Don't indent second line of single-line paragraphs if autoindent is off */
+ 			int x = zlen(indents);
+ 			while (x && (indents[x - 1] == ' ' || indents[x - 1] == '\t'))
+ 				indents[--x] = 0;
+-			if (x) {
++			if ((x) && (x < indents_size)) {
+ 				indents[x++] = ' ';
+ 				indents[x] = 0;
+ 			}
diff --git a/joe.spec b/joe.spec
index ac78625..a248d74 100644
--- a/joe.spec
+++ b/joe.spec
@@ -1,7 +1,7 @@
 Summary: An easy to use, modeless text editor
 Name: joe
 Version: 3.7
-Release: 5%{?dist}
+Release: 6%{?dist}
 License: GPLv2+
 Group: Applications/Editors
 Source: http://downloads.sourceforge.net/joe-editor/joe-%{version}.tar.gz
@@ -11,6 +11,7 @@ Patch0: joe-3.7-joerc.patch
 Patch2: joe-3.4-selinux.patch
 Patch3: joe-3.5-time.patch
 Patch4: joe-3.7-orphan.patch
+Patch5: joe-3.7-indent-ow.patch
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
 %description
@@ -24,6 +25,7 @@ environment.
 %patch2 -p1 -b .selinux
 %patch3 -p1 -b .time
 %patch4 -p1 -b .orphan
+%patch5 -p1 -b .of
 iconv -f koi8-r -t utf-8 ./man/ru/joe.1.in >./man/ru/joe.1.in.aux
 touch -r ./man/ru/joe.1.in ./man/ru/joe.1.in.aux
 mv ./man/ru/joe.1.in.aux ./man/ru/joe.1.in
@@ -65,6 +67,10 @@ popd
 rm -rf $RPM_BUILD_ROOT
 
 %changelog
+* Mon Jan  3 2011 Ivana Hutarova Varekova <varekova at redhat.com> - 3.7-6
+- Resolves: #663503
+  memory corruption problem in wrapword function
+
 * Wed Feb 10 2010 Ivana Hutarova Varekova <varekova at redhat.com> - 3.7-5
 - fix 528817 - problem when orphan mode is set