From 2ec4b8f9ed0df231d01d7072a5233927974e890e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ji=C5=99=C3=AD=20Moskov=C4=8D=C3=A1k?=
 <jmoskovc@fedoraproject.org>
Date: Wed, 9 Jan 2008 12:13:52 +0000
Subject: [PATCH] Fixed crash when using '$' as formatting character in
 translation string.

---
 lynx-2.8.6-fmt_string.patch | 97 +++++++++++++++++++++++++++++++++++++
 lynx.spec                   |  8 ++-
 2 files changed, 104 insertions(+), 1 deletion(-)
 create mode 100644 lynx-2.8.6-fmt_string.patch

diff --git a/lynx-2.8.6-fmt_string.patch b/lynx-2.8.6-fmt_string.patch
new file mode 100644
index 0000000..6d8b421
--- /dev/null
+++ b/lynx-2.8.6-fmt_string.patch
@@ -0,0 +1,97 @@
+--- lynx2-8-6/WWW/Library/Implementation/HTString.c_old	2007/05/16 21:44:23	1.49
++++ lynx2-8-6/WWW/Library/Implementation/HTString.c	2008/01/09 00:06:06
+@@ -619,6 +619,46 @@
+ 					    const char *fmt,
+ 					    va_list * ap)
+ {
++#ifdef HAVE_VASPRINTF
++    /*
++     * Use vasprintf() if we have it, since it is simplest.
++     */
++    char *result = 0;
++    char *temp = 0;
++
++    /* discard old destination if no length was given */
++    if (pstr && !dst_len) {
++	if (*pstr)
++	    FREE(*pstr);
++    }
++
++    if (vasprintf(&temp, fmt, *ap) >= 0) {
++	if (dst_len != 0) {
++	    int src_len = strlen(temp);
++	    int new_len = dst_len + src_len + 1;
++
++	    result = HTAlloc(pstr ? *pstr : 0, new_len);
++	    if (result != 0) {
++		strcpy(result + dst_len, temp);
++		mark_malloced(temp, new_len);
++	    }
++	    free(temp);
++	} else {
++	    result = temp;
++	    mark_malloced(temp, strlen(temp));
++	}
++    }
++
++    if (pstr != 0)
++	*pstr = result;
++
++    return result;
++#else /* !HAVE_VASPRINTF */
++    /*
++     * If vasprintf() is not available, this works - but does not implement
++     * the POSIX '$' formatting character which may be used in some of the
++     * ".po" files.
++     */
+ #ifdef SAVE_TIME_NOT_SPACE
+     static size_t tmp_len = 0;
+     static size_t fmt_len = 0;
+@@ -634,20 +674,9 @@
+     char *dst_ptr = *pstr;
+     const char *format = fmt;
+ 
+-    if (fmt == 0 || *fmt == '\0')
++    if (isEmpty(fmt))
+ 	return 0;
+ 
+-#ifdef USE_VASPRINTF
+-    if (pstr && !dst_len) {
+-	if (*pstr)
+-	    FREE(*pstr);
+-	if (vasprintf(pstr, fmt, *ap) >= 0) {
+-	    mark_malloced(*pstr, strlen(*pstr) + 1);
+-	    return (*pstr);
+-	}
+-    }
+-#endif /* USE_VASPRINTF */
+-
+     need = strlen(fmt) + 1;
+ #ifdef SAVE_TIME_NOT_SPACE
+     if (!fmt_ptr || fmt_len < need * NUM_WIDTH) {
+@@ -848,6 +877,7 @@
+     if (pstr)
+ 	*pstr = dst_ptr;
+     return (dst_ptr);
++#endif /* HAVE_VASPRINTF */
+ }
+ #undef SAVE_TIME_NOT_SPACE
+ 
+@@ -895,16 +925,7 @@
+ 
+     LYva_start(ap, fmt);
+     {
+-#ifdef USE_VASPRINTF
+-	if (pstr) {
+-	    if (*pstr)
+-		FREE(*pstr);
+-	    if (vasprintf(pstr, fmt, ap) >= 0)	/* else call outofmem?? */
+-		mark_malloced(*pstr, strlen(*pstr) + 1);
+-	    result = *pstr;
+-	} else
+-#endif /* USE_VASPRINTF */
+-	    result = StrAllocVsprintf(pstr, 0, fmt, &ap);
++	result = StrAllocVsprintf(pstr, 0, fmt, &ap);
+     }
+     va_end(ap);
+ 
diff --git a/lynx.spec b/lynx.spec
index 9cfec95..69b1d30 100644
--- a/lynx.spec
+++ b/lynx.spec
@@ -1,7 +1,7 @@
 Summary: A text-based Web browser
 Name: lynx
 Version: 2.8.6
-Release: 10%{?dist}
+Release: 11%{?dist}
 License: GPL
 Group: Applications/Internet
 Source: http://lynx.isc.org/current/lynx%{version}.tar.bz2
@@ -10,6 +10,7 @@ Patch0: lynx-2.8.6-redhat.patch
 Patch1: lynx-crash.patch
 Patch2: lynx-2.8.6-options.patch
 Patch3: lynx-2.8.6-backgrcolor.patch
+Patch4: lynx-2.8.6-fmt_string.patch
 Requires: indexhtml
 Provides: webclient
 Provides: text-www-browser
@@ -29,6 +30,7 @@ exits quickly and swiftly displays webpages.
 %patch1 -p1 -b .crash
 %patch2 -p1 -b .opt
 %patch3 -p1 -b .bgcol
+%patch4 -p1 -b .fmt_string
 perl -pi -e "s,^HELPFILE:.*,HELPFILE:file://localhost/usr/share/doc/lynx-%{version}/lynx_help/lynx_help_main.html,g" lynx.cfg
 perl -pi -e "s,^DEFAULT_INDEX_FILE:.*,DEFAULT_INDEX_FILE:http://www.google.com/,g" lynx.cfg
 perl -pi -e 's,^#LOCALE_CHARSET:.*,LOCALE_CHARSET:TRUE,' lynx.cfg
@@ -100,6 +102,10 @@ rm -rf $RPM_BUILD_ROOT
 %config(noreplace,missingok) %{_sysconfdir}/lynx-site.cfg
 
 %changelog
+* Tue Jan  8 2008 Jiri Moskovcak <jmoskovc@redhat.com> - 2.8.6-11
+- fixed crash when using formatting character '$' in translation
+- Resolves: #426449
+
 * Tue Dec 11 2007 Ivana Varekova <varekova@redhat.com> - 2.8.6-10
 - add default-colors option, change default setting (#409211)