[BusyBox 0003874]: Applet vi corrupted since Revision 22460

[bugs at busybox.net]

A NOTE has been added to this issue. 
====================================================================== 
http://busybox.net/bugs/view.php?id=3874 
====================================================================== 
Reported By:                rockeychu
Assigned To:                BusyBox
====================================================================== 
Project:                    BusyBox
Issue ID:                   3874
Category:                   Other
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     assigned
====================================================================== 
Date Submitted:             06-26-2008 19:53 PDT
Last Modified:              06-26-2008 21:17 PDT
====================================================================== 
Summary:                    Applet vi corrupted since Revision 22460
Description: 
Since Revision 22460, the applet vi worked incorrectly.

Patch as following against revision 22525:

Index: editors/vi.c
===================================================================
--- editors/vi.c        (revision 22525)
+++ editors/vi.c        (working copy)
@@ -1883,8 +1883,7 @@
 {
        if (size <= 0)
                return p;
-       end += size;            // adjust the new END
-       if (end >= (text + text_size)) {
+       if ((end + size) >= (text + text_size)) {
                char *new_text;
                text_size += end - (text + text_size) + 10240;
                new_text = xrealloc(text, text_size);
@@ -1895,6 +1894,7 @@
                text = new_text;
        }
        memmove(p + size, p, end - p);
+       end += size;            // adjust the new END
        memset(p, ' ', size);   // clear new hole
        file_modified++;
        return p;

====================================================================== 

---------------------------------------------------------------------- 
 vda - 06-26-08 21:01  
---------------------------------------------------------------------- 
Should this line be fixed too?

text_size += end - (text + text_size) + 10240; 

---------------------------------------------------------------------- 
 vda - 06-26-08 21:05  
---------------------------------------------------------------------- 
I will commit this fix instead, is it ok?

-       memmove(p + size, p, end - p);
+       memmove(p + size, p, end - size - p); 

---------------------------------------------------------------------- 
 rockeychu - 06-26-08 21:17  
---------------------------------------------------------------------- 
It's OK. 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
06-26-08 19:53  rockeychu      New Issue                                    
06-26-08 19:53  rockeychu      Status                   new => assigned     
06-26-08 19:53  rockeychu      Assigned To               => BusyBox         
06-26-08 21:01  vda            Note Added: 0008604                          
06-26-08 21:05  vda            Note Added: 0008614                          
06-26-08 21:17  rockeychu      Note Added: 0008624                          
======================================================================