Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!watmath!clyde!burl!ulysses!allegra!mit-eddie!think!harvard!seismo!mcvax!ukc!hrc63!miduet!steve
From: steve@miduet.mifnet.gec-mi-ate.co.uk (Steve Lademann)
Newsgroups: net.bugs.usg,net.bugs.4bsd,net.unix-wizards
Subject: Bug in vanilla System V terminfo
Message-ID: <140@miduet.mifnet.gec-mi-ate.co.uk>
Date: Thu, 24-Apr-86 07:54:12 EDT
Article-I.D.: miduet.140
Posted: Thu Apr 24 07:54:12 1986
Date-Received: Sun, 27-Apr-86 06:46:01 EDT
Organization: Marconi Instruments Ltd., St.Albans, UK
Lines: 28
Xref: watmath net.bugs.usg:481 net.bugs.4bsd:2073 net.unix-wizards:17827

There is a 'lurker' in the terminfo supplied with vanilla System V.2
which exhibits itself by causing a process using the keypad code in
terminfo to occasionally core dump mysteriously. On editing in some
debug information, it stops core dumping.

This is due to a bad condition on a 'for' loop at line 111 (or
thereabouts).  The condition reads.

		for(i=0; SP->kp[i].keynum >= 0; i++)

which causes it to whiz off through memory looking for a key which is
numbered negatively, whereas the code marks the entry after the last
key in the array as 0.

The (obvious) cure is therefore

		for(i=0; SP->kp[i].keynum > 0; i++)


-----------------------------------------------------------------
|Steve Lademann		|Phone:	44 727 59292 x326		|
|Marconi Instruments Ltd|UUCP : ...mcvax!ukc!hrc63!miduet!steve	|
|St. Albans		|NRS  : steve@uk.co.gec-mi-ate.mifnet	|
|Herts.   UK		|					|
-----------------------------------------------------------------
|"The views expressed herein do not necessarily reflect"|	|
|"those of my employer, and may not even reflect my own"|	|
-----------------------------------------------------------------