X-Git-Url: https://git.subgeniuskitty.com/unix-history/.git/blobdiff_plain/d80219281a87d20eb183a6e35b46698696c1073f..641aea2eb1957ed8dd71edf70e7438e04d131fff:/usr.bin/sed/process.c

diff --git a/usr.bin/sed/process.c b/usr.bin/sed/process.c
index 75b08dcde8..f1a4e9e9f2 100644
--- a/usr.bin/sed/process.c
+++ b/usr.bin/sed/process.c
@@ -315,10 +315,13 @@ substitute(cp)
 	SPACE tspace;
 	regex_t *re;
 	size_t re_off;
+	size_t re_eoff;
 	int n;
 	char *s;
+	char *eos;
 
 	s = ps;
+	eos = s + strlen(s);
 	re = cp->u.s->re;
 	if (re == NULL) {
 		if (defpreg != NULL && cp->u.s->maxbref > defpreg->re_nsub) {
@@ -337,13 +340,16 @@ substitute(cp)
 		do {
 			/* Locate start of replaced string. */
 			re_off = match[0].rm_so;
+			re_eoff = match[0].rm_eo;
 			/* Copy leading retained string. */
 			cspace(&SS, s, re_off, APPEND);
 			/* Add in regular expression. */
 			regsub(&SS, s, cp->u.s->new);
 			/* Move past this match. */
 			s += match[0].rm_eo;
-		} while(regexec_e(re, s, REG_NOTBOL, 0));
+		} while(*s && re_eoff && regexec_e(re, s, REG_NOTBOL, 0));
+		if (eos - s > 0 && !re_eoff)
+			err(FATAL, "infinite substitution loop");
 		/* Copy trailing retained string. */
 		cspace(&SS, s, strlen(s), APPEND);
 		break;
@@ -564,7 +570,8 @@ cspace(sp, p, len, spflag)
 	 * need two extra bytes, one for the newline, one for a terminating
 	 * NULL.
 	 */
-	tlen = sp->len + len + spflag == APPENDNL ? 2 : 1;
+/*	tlen = sp->len + len + spflag == APPENDNL ? 2 : 1; */
+	tlen = sp->len + len + (spflag == APPENDNL ? 2 : 1);  /* XXX */
 	if (tlen > sp->blen) {
 		sp->blen = tlen + 1024;
 		sp->space = sp->back = xrealloc(sp->back, sp->blen);