Grab fix from upstream for segfaults with some files #111564.

(Portage version: 2.1_pre4-r1)

2 files changed, 64 insertions, 0 deletions

diff --git a/app-editors/nano/files/digest-nano-1.3.10 b/app-editors/nano/files/digest-nano-1.3.10-r1
index f0410784444b..f0410784444b 100644
--- a/app-editors/nano/files/digest-nano-1.3.10
+++ b/app-editors/nano/files/digest-nano-1.3.10-r1
diff --git a/app-editors/nano/files/nano-1.3.10-crash.patch b/app-editors/nano/files/nano-1.3.10-crash.patch
new file mode 100644
index 000000000000..f0fdd856b6c7
--- /dev/null
+++ b/app-editors/nano/files/nano-1.3.10-crash.patch
@@ -0,0 +1,64 @@
+http://bugs.gentoo.org/111564
+http://lists.gnu.org/archive/html/nano-devel/2006-02/msg00006.html
+
+diff -ur nano-1.3.7/src/winio.c nano-1.3.7-fixed/src/winio.c
+--- nano-1.3.7/src/winio.c	2005-04-10 23:51:22.000000000 -0400
++++ nano-1.3.7-fixed/src/winio.c	2006-02-02 23:47:01.000000000 -0500
+@@ -2253,10 +2253,22 @@
+ 
+     assert(column <= start_col);
+ 
+-    /* Allocate enough space for the entire line. */
+-    alloc_len = (mb_cur_max() * (COLS + 1));
++    /* Make sure there's enough room for the initial character, whether
++     * it's a multibyte control character, a non-control multibyte
++     * character, a tab character, or a null terminator.  Rationale:
++     *
++     * multibyte control character followed by a null terminator:
++     *     1 byte ('^') + mb_cur_max() bytes + 1 byte ('\0')
++     * multibyte non-control character followed by a null terminator:
++     *     mb_cur_max() bytes + 1 byte ('\0')
++     * tab character followed by a null terminator:
++     *     mb_cur_max() bytes + (tabsize - 1) bytes + 1 byte ('\0')
++     *
++     * Since tabsize has a minimum value of 1, it can substitute for 1
++     * byte above. */
++    alloc_len = (mb_cur_max() + tabsize + 1) * 128;
++    converted = charalloc(alloc_len);
+ 
+-    converted = charalloc(alloc_len + 1);
+     index = 0;
+ 
+     if (buf[start_index] != '\t' && (column < start_col || (dollars &&
+@@ -2295,9 +2306,17 @@
+ #endif
+     }
+ 
+-    while (index < alloc_len - 1 && buf[start_index] != '\0') {
++    while (buf[start_index] != '\0') {
+ 	buf_mb_len = parse_mbchar(buf + start_index, buf_mb, NULL);
+ 
++	/* Make sure there's enough room for the next character, whether
++	 * it's a multibyte control character, a non-control multibyte
++	 * character, a tab character, or a null terminator. */
++	if (index + mb_cur_max() + tabsize + 1 >= alloc_len - 1) {
++	    alloc_len += (mb_cur_max() + tabsize + 1) * 128;
++	    converted = charealloc(converted, alloc_len);
++	}
++
+ 	/* If buf contains a tab character, interpret it. */
+ 	if (*buf_mb == '\t') {
+ #if !defined(NANO_SMALL) && defined(ENABLE_NANORC)
+@@ -2379,8 +2398,10 @@
+ 	start_index += buf_mb_len;
+     }
+ 
+-    if (index < alloc_len - 1)
+-	converted[index] = '\0';
++    assert(alloc_len >= index + 1);
++
++    /* Null terminate converted. */
++    converted[index] = '\0';
+ 
+     /* Make sure converted takes up no more than len columns. */
+     index = actual_x(converted, len);