functional error) in c_gets(), file chared.c.
Run any program using libedit in the default way. At the el_[w]gets()
prompt, invoke ed-command (for example, in emacs mode, press the
escape key, then type the letter 'x'). You should see a ": " prompt.
Type the letter 'x' again. Now press the backspace key a few times,
looking at the screen after each key press:
- The 1st BS deletes the 'x'.
- The 2nd BS deletes the blank after the prompt.
- The 3rd BS deletes the colon of the prompt.
- The 4th BS moves the cursor up one line.
- The 5th BS gives me "Segmentation fault (core dumped)".
Depending on your platform, it might take a few more or a few less
backspaces for the buffer underrun to trigger the segfault, but
you should be able to hit it sooner or later no matter what.
Run the same program again, connect again and invoke ed-command again.
Now type: 'b', backspace, 'i', backspace, 'n', backspace, 'd', enter.
The "bind" command gets executed, even though you deleted what you
typed before hitting enter.
From Ingo Schwatze.
5f47d9bd72