Segmentation fault caused by bug in makeinfo

[Andreas Vögele]

There seems to be a bug in textinfo/makeinfo/multi.c in the function 
output_multitable_row().

If a column contains only whitespace the following code may cause a 
segmentation fault.  The problem is that the offset is only checked for 
zero before the loop but not while the loop is decrementing the offset.

  /* remove trailing whitespace from each column */
  [...]
  if (envs[i].output_paragraph_offset)
    while (cr_or_whitespace (CHAR_AT (envs[i].output_paragraph_offset - 
1)))
      envs[i].output_paragraph_offset--;

I can reproduce this problem under OpenBSD-current when building the 
documentation for Automake 1.9.5. The bug is also present in the CVS at 
savannah.gnu.org.

Makeinfo doesn't crash if the offset is checked in the loop:

  while (envs[i].output_paragraph_offset
         && cr_or_whitespace (CHAR_AT (envs[i].output_paragraph_offset 
- 1)))
    envs[i].output_paragraph_offset--;

patch-makeinfo_multi_c
Description: Binary data