editors/nvi: nex segfault calling libncurses.5.4.dylib:tputs() on OSX 10.10.5

[twinshadow]

branch: trunk
commit: 925700e
reproducible: yes

There appears to be an issue with the way that cl/cl_screen.c calls tputs on OSX with the default curses option, passing it a bad address or with an improper function signature.

(lldb) target create ".local/bin/nex"
Current executable set to '.local/bin/nex' (x86_64).
(lldb) r
Process 48431 launched: '/Users/jcdenton/.local/bin/nex' (x86_64)
./en_US.UTF-8: No such file or directory
Process 48431 stopped
* thread #1: tid = 0x3162844, 0x00007fff92ad259d libncurses.5.4.dylib`tputs + 170, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x603480)
    frame #0: 0x00007fff92ad259d libncurses.5.4.dylib`tputs + 170
libncurses.5.4.dylib`tputs:
->  0x7fff92ad259d <+170>: movsbl (%rbx), %edi
    0x7fff92ad25a0 <+173>: cmpl   $0x24, %edi
    0x7fff92ad25a3 <+176>: jne    0x7fff92ad265e            ; <+363>
    0x7fff92ad25a9 <+182>: movzbl 0x1(%rbx), %eax
(lldb) bt
* thread #1: tid = 0x3162844, 0x00007fff92ad259d libncurses.5.4.dylib`tputs + 170, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x603480)
  * frame #0: 0x00007fff92ad259d libncurses.5.4.dylib`tputs + 170
    frame #1: 0x0000000100003fd4 nex`cl_screen + 852
    frame #2: 0x0000000100035bd9 libvi.0.dylib`ex_init + 57
    frame #3: 0x000000010000e877 libvi.0.dylib`ex + 71
    frame #4: 0x00000001000419b9 libvi.0.dylib`editor + 4617
    frame #5: 0x000000010000272b nex`main + 603
    frame #6: 0x00007fff95a225c9 libdyld.dylib`start + 1
    frame #7: 0x00007fff95a225c9 libdyld.dylib`start + 1
(lldb) register read
General Purpose Registers:
       rax = 0x0000000000002501
       rbx = 0x0000000000603480
       rcx = 0x00000000ffffffff
       rdx = 0x00007fff92ae8f8c  libncurses.5.4.dylib`_nc_tinfo_fkeys + 1404
       rdi = 0x0000000000002580
       rsi = 0x000000000000000d
       rbp = 0x00007fff5fbff690
       rsp = 0x00007fff5fbff660
        r8 = 0x0000000000000000
        r9 = 0x00007fff8ba8cd60  libsystem_c.dylib`zeroes
       r10 = 0x00000000000029a0
       r11 = 0x00007fff92ad24f3  libncurses.5.4.dylib`tputs
       r12 = 0x0000000000000000
       r13 = 0x00007fff78fc0cd8  libncurses.5.4.dylib`cur_term
       r14 = 0x0000000000000000
       r15 = 0x0000000100006490  nex`cl_putchar
       rip = 0x00007fff92ad259d  libncurses.5.4.dylib`tputs + 170
    rflags = 0x0000000000010246
        cs = 0x000000000000002b
        fs = 0x0000000000000000
        gs = 0x0000000000000000
(lldb) up
frame #1: 0x0000000100003fd4 nex`cl_screen + 852
nex`cl_screen:
    0x100003fd4 <+852>: movl   %eax, -0x64(%rbp)
    0x100003fd7 <+855>: jmp    0x100004028               ; <+936>
    0x100003fdc <+860>: movq   -0x10(%rbp), %rdi
    0x100003fe0 <+864>: callq  0x100004450               ; cl_vi_init
(lldb) register read
General Purpose Registers:
       rbx = 0x0000000000000000
       rbp = 0x00007fff5fbff710
       rsp = 0x00007fff5fbff6a0
       r12 = 0x0000000000000000
       r13 = 0x0000000000000000
       r14 = 0x0000000000000000
       r15 = 0x0000000000000000
       rip = 0x0000000100003fd4  nex`cl_screen + 852
13 registers were unavailable.

The code in question, cl/cl_screen.c:

               /*
                * If doing an ex screen for ex mode, move to the last line
                * on the screen.
                */
               if (F_ISSET(sp, SC_EX) && clp->cup != NULL)
                       tputs(tgoto(clp->cup,
                           0, O_VAL(sp, O_LINES) - 1), 1, cl_putchar);

The build options output:

The following variables will affect the build process of this package,
nvi-1.81.6nb10.  Their current value is shown below:

        * BDB185_DEFAULT = db1
        * BDB_DEFAULT = db4
        * CURSES_DEFAULT = curses

Based on these variables, the following variables have been set:

        * BDBBASE (defined, but empty)
        * BDB_LIBS = -ldb4
        * BDB_TYPE = db4
        * CURSES_TYPE = curses

I am currently working around the code with a patch to ifdef-disable the tputs call, which only results in a cosmetic difference in the startup of nex.

[mamash]

Meanwhile a set of patches was provided in joyent/pkgsrc/pull/463 and I just merged this into pkgsrc trunk. Thanks for the report!