On Sun, Mar 02, 2008 at 11:19:34PM +0100, Otto Moerbeek wrote:
quoted text
> Hmmm, it does not solve all cases. The cursor position does not get
> updated when you type a tab that should position the cursor a the
> beginning of the next line for lon lines. I have also seen some other
> core dumps when going out of insert mode for lines cotaining lots of tabs.
> 
> 	-Otto

Hey guys, could you give this patch a try? I believe it fixes the
problem, but I have not been able to test it extensively.

The code that keeps track of the number of columns a particular
line takes was not quite right. Without this patch, "curoff" is
behind by 8 characters, and so when you hit a tab at the
beginning of the second terminal line, the TAB_RESET macro
actually subtracts 8 from scno. So at the beginning of the second
terminal line scno (the number of columns) is 80, then after another
tab it is still at 80, which causes all sorts of stuff to go
haywire :P

-Nate


--- vs_relative.c.orig	Tue Mar  4 00:54:55 2008
+++ vs_relative.c	Tue Mar  4 00:55:06 2008
@@ -117,10 +117,13 @@
 	 * Initialize the screen offset.
 	 */
 	scno = 0;
+	curoff = 0;
 
 	/* Leading number if O_NUMBER option set. */
-	if (O_ISSET(sp, O_NUMBER))
+	if (O_ISSET(sp, O_NUMBER)) {
 		scno += O_NUMBER_LENGTH;
+		curoff += O_NUMBER_LENGTH;
+	}
 
 	/* Need the line to go any further. */
 	if (lp == NULL) {
@@ -141,11 +144,9 @@
 	leftright = O_ISSET(sp, O_LEFTRIGHT);
 
 	/*
-	 * Initialize the pointer into the buffer and screen and current
-	 * offsets.
+	 * Initialize the pointer into the buffer.
 	 */
 	p = lp;
-	curoff = 0;
 
 	/* Macro to return the display length of any signal character. */
 #define	CHLEN(val) (ch = *(u_char *)p++) == '\t' &&			\


 
quoted text
>  On Sunday 02 March 2008 03:13:37 natex84@gmail.com wrote:
> >Number:         5749
> >Category:       system
> >Synopsis:       vi crashes due to multiple tabs with line numbering on
> >Confidential:   yes
> >Severity:       non-critical
> >Priority:       low
> >Responsible:    bugs
> >State:          open
> >Quarter:
> >Keywords:
> >Date-Required:
> >Class:          sw-bug
> >Submitter-Id:   net
> >Arrival-Date:   Sun Mar 02 02:20:01 GMT 2008
> >Closed-Date:
> >Last-Modified:
> >Originator:     Nathan Houghton
> >Release:        OpenBSD 4.2
> >Organization:
>
> net
>
> >Environment:
>
> 	System      : OpenBSD 4.2
> 	Details     : OpenBSD 4.2-stable (GENERIC) #2: Tue Feb 26 08:44:52 EST
> 2008 root@iron.brainwerk.org:/usr/src/sys/arch/i386/compile/GENERIC
>
> 	Architecture: OpenBSD.i386
> 	Machine     : i386
>
> >Description:
>
> 	When vi has numbering enabled (:set number) it is possible to
> 	cause vi to crash by entering multiple tabs.
>
> >How-To-Repeat:
>
> 	The easiest way to reproduce this is to start vi with no
> 	arguments and then turn on numbering (if it is not already on)
> 	and then enter insert mode and press tab 18 times. When the
> 	cursor reaches near the end of the second line it will lock up
> 	and eventually crash.
>
> 	The 'magic' number 18 is different depending on the tabstop
> 	setting (18 is with the default of 8). It seems to crash right
> 	when a tab is pressed that causes it to loop around the edge of
> 	the terminal onto the second terminal line.
>
> >Fix:
>
> 	I do not have a fix. I took a look at some of the code and the
> 	stack is overflowing due to line 699 in vi/vi/vs_refresh.c. The
> 	vs_paint function calls itself on failure (to try again I
> 	guess). The problem is that it never suceeds.
>
> 	The call to vs_line in the for loop on line 669 never seems to
> 	return a value in "y" other than -1. vip->sc_smap is therefore
> 	never updated and remains NULL (and causes the failure
> 	on line 669).
>
> 	I'm not sure where the problem is.