The command `echo a|./fmt -2147483647' would cause fmt to segfault.

(fmt_paragraph): Test for sentinal directly, rather than
doing arithmetic with it's potentially large (INT_MAX) length.

diff --git a/src/fmt.c b/src/fmt.c
index 85b347f9a8ba49dc420384e9b0293e83c636469c..c7427dba4de3cd8aec6e536c12f74e8efb92571c 100644 (file)
--- a/src/fmt.c
+++ b/src/fmt.c
@@ -816,6 +816,14 @@ fmt_paragraph (void)
              start->next_break = w;
              start->line_length = len;
            }
+
+         /* This is a kludge to keep us from computing `len' as the
+            sum of the sentinel length and some non-zero number.
+            Since the sentinel w->length may be INT_MAX, adding
+            to that would give a negative result.  */
+         if (w == word_limit)
+           break;
+
          len += (w - 1)->space + w->length;    /* w > start >= word */
        }
       while (len < max_width);