From: utzoo!decvax!microsof!uw-beave!jim
Newsgroups: net.bugs.uucp
Title: Re: BAD READ
Article-I.D.: uw-beave.116
Posted: Wed Sep 22 10:32:40 1982
Received: Mon Sep 27 19:50:23 1982
References: uw-beave.114

Never mind, I found it.  In anlwrk.c, routine iswrk(), the line

	if (listp == NULL || *listp == NULL || listp > (list + LLEN)

should read

	if (listp == NULL || *listp == NULL || listp >= (list + LLEN)

Otherwise it will crash when it gets to the LLEN+1th work file.

Before I could find this, I had to fix intrEXIT() in cico.c.  In 4.1bsd, a
call to abort() does not result in a SIGIOT.  I don't know what it does
result in, and I suppose it could change some time, so I reset all the
signals by changing

	signal(i, SIG_DFL);

to

	int i;

	for (i=1; i<16; i++)
		signal(i, SIG_DFL);

I guess it would be better to explicitly name all the signals in case some
other Unix doesn't number them 1-15, but I'm basically lazy.  Before I made
this fix, the call to abort() resulted in some signal, which called
intrEXIT(), which didn't reset the signal but did cause another.  This gave
a vicious recursive cycle and it didn't actually quit until it ran out of
stack space (512K on our system).

I assume some one else has already tracked down these bugs and other equally
offensive ones.  Could someone please send me the rest of the fixes?