From: utzoo!decvax!microsof!uw-beave!jim Newsgroups: net.bugs.uucp Title: Re: BAD READ Article-I.D.: uw-beave.116 Posted: Wed Sep 22 10:32:40 1982 Received: Mon Sep 27 19:50:23 1982 References: uw-beave.114 Never mind, I found it. In anlwrk.c, routine iswrk(), the line if (listp == NULL || *listp == NULL || listp > (list + LLEN) should read if (listp == NULL || *listp == NULL || listp >= (list + LLEN) Otherwise it will crash when it gets to the LLEN+1th work file. Before I could find this, I had to fix intrEXIT() in cico.c. In 4.1bsd, a call to abort() does not result in a SIGIOT. I don't know what it does result in, and I suppose it could change some time, so I reset all the signals by changing signal(i, SIG_DFL); to int i; for (i=1; i<16; i++) signal(i, SIG_DFL); I guess it would be better to explicitly name all the signals in case some other Unix doesn't number them 1-15, but I'm basically lazy. Before I made this fix, the call to abort() resulted in some signal, which called intrEXIT(), which didn't reset the signal but did cause another. This gave a vicious recursive cycle and it didn't actually quit until it ran out of stack space (512K on our system). I assume some one else has already tracked down these bugs and other equally offensive ones. Could someone please send me the rest of the fixes?