Re: "info --vi-keys foo" inciting a segfault in info

[Eli Zaretskii]

On Tue, 14 Aug 2001, Colin Watson wrote:

> Here's a backtrace from Debian info 4.0b-2 on i386, compiled with
> debugging symbols and with libefence.so preloaded:

Thank you for your report.

> (gdb) frame
> #2  0x08051221 in where_is_internal (map=0x40634800, 
>     function=0x805c004 <info_move_to_window_line>) at infodoc.c:793
> 793               sprintf (where_is_rep + where_is_rep_index, "%s ",
> (gdb) p where_is_rep
> $4 = 0x40590f9c "ESC ESC C-x C-x C-x C-x ESC ESC C-x C-x C-x C-x C-x ESC ESC 
> C-x C-x ESC C-x ESC ESC C-x ESC ESC [ 3 "
> (gdb) p where_is_rep_index
> $5 = 98

How did you come up with such a monstrous escape sequence?  Also, how
come info_move_to_window_line has a key binding under --vi-keys?  I
don't seem to see that in Texinfo 4.0b's vi-like keymap (see
infomap.c).

Anyway, I think the following changes should fix this; please try:

2001-08-26  Eli Zaretskii  <address@hidden>

        * info/infodoc.c (where_is_make_room): New function.
        (where_is, where_is_internal): Use it to reallocate where_is_rep
        if there's not enough room in it to put the printed representation
        of a key.

--- info/infodoc.c~0    Sat Sep 25 18:30:54 1999
+++ info/infodoc.c      Sun Aug 26 14:24:08 2001
@@ -737,6 +737,20 @@ static char *where_is_rep = (char *)NULL
 static int where_is_rep_index = 0;
 static int where_is_rep_size = 0;
 
+/* Make sure there's enough room in where_is_rep to put a string whose
+   size is SIZE, beginning from offset OFFSET.  If there's not enough
+   room, reallocate where_is_rep.  */
+static void
+where_is_make_room (offset, size)
+     size_t offset, size;
+{
+  if (where_is_rep_size - offset <= size)
+    {
+      where_is_rep_size = size + offset + 100;
+      where_is_rep = xrealloc (where_is_rep, where_is_rep_size);
+    }
+}
+
 static char *
 where_is (map, function)
      Keymap map;
@@ -758,7 +772,12 @@ where_is (map, function)
       name = function_name (function);
 
       if (name)
-        sprintf (where_is_rep, "M-x %s", name);
+        {
+          size_t name_len = strlen (name);
+
+          where_is_make_room (0, name_len);
+          sprintf (where_is_rep, "M-x %s", name);
+        }
 
       rep = where_is_rep;
     }
@@ -778,7 +797,10 @@ where_is_internal (map, function)
   for (i = 0; i < 256; i++)
     if ((map[i].type == ISFUNC) && map[i].function == function)
       {
-        sprintf (where_is_rep + where_is_rep_index, "%s", pretty_keyname (i));
+        char *keyname = pretty_keyname (i);
+
+        where_is_make_room (where_is_rep_index, strlen (keyname));
+        sprintf (where_is_rep + where_is_rep_index, "%s", keyname);
         return (where_is_rep);
       }
 
@@ -789,9 +811,10 @@ where_is_internal (map, function)
         {
           int saved_index = where_is_rep_index;
           char *rep;
+          char *keyname = pretty_keyname (i);
 
-          sprintf (where_is_rep + where_is_rep_index, "%s ",
-                   pretty_keyname (i));
+          where_is_make_room (where_is_rep_index, strlen (keyname));
+          sprintf (where_is_rep + where_is_rep_index, "%s ", keyname);
 
           where_is_rep_index = strlen (where_is_rep);
           rep = where_is_internal ((Keymap)map[i].function, function);