Problem with re_tag_conv from usr.bin/vi/ex/ex_subst.c

[Mathew Richardson <mrr_(_at_)_merit_(_dot_)_edu>]

If you are using a tag that ends in "\\/" or "\\?" vi cores.  (Presumably
so does ex.)  A potential fix would be to make len in re_tag_conv some
signed type rather than a size_t.  This introduces the need to do an
additional comparison in the for loop, to prevent copying over the \\ from
the final / or ? character.

Attached is a patch.

mrr

*** ex_subst.c.old	Sun Nov  7 02:02:26 1999
--- ex_subst.c	Sun Nov  7 02:00:00 1999
***************
*** 1179,1183 ****
  	int *replacedp;
  {
! 	size_t blen, len;
  	int lastdollar;
  	char *bp, *p, *t;
--- 1179,1184 ----
  	int *replacedp;
  {
! 	size_t blen;
! 	signed long len;
  	int lastdollar;
  	char *bp, *p, *t;
***************
*** 1226,1230 ****
  		} else if (strchr("^.[]$*", p[0]))
  			*t++ = '\\';
! 		*t++ = *p++;
  	}
  	if (lastdollar)
--- 1227,1232 ----
  		} else if (strchr("^.[]$*", p[0]))
  			*t++ = '\\';
! 		if (len)
! 			*t++ = *p++;
  	}
  	if (lastdollar)