segfault in rlog.c

Ray Bellis <[email protected]> Wed, 26 Jan 2022 12:23:27 +0000
Newsgroups gmane.comp.version-control.rcs.bugs
Message-ID <[email protected]>
[I already added this to the online bug DB as 
http://savannah.gnu.org/bugs/index.php?61932]

Our Twiki installation has a bunch of RCS files with old commits where 
the final `a` line in the comma-v file has an extra trailing newline 
before the closing `@` line.

Reading these files with `rcs log` causes a segfault in the `count_a_d` 
function, because the `strchr` call looking for a space character 
returns NULL, which is then passed to the `read_positive_integer` function.

If I insert:

   if (!p) break;

after the strchr call then the log can be read successfully.

The installation is FreeBSD 12.3, using rcs 5.10.0 from the FreeBSD pkg 
repository, recently upgraded from FreeBSD 12.2.

As yet I've been unable to determine why this apparently never 
previously caused us an issue.

cheers,

Ray