5027709 whline() and wvline() may cause SEGV.

4503183 box() causes SEGV
5089079 delterm() dereferences a freed pointer

5 files changed, 37 insertions, 25 deletions

diff --git a/usr/src/lib/libcurses/screen/delterm.c b/usr/src/lib/libcurses/screen/delterm.c
index ed18699330..e3fb61773a 100644
--- a/usr/src/lib/libcurses/screen/delterm.c
+++ b/usr/src/lib/libcurses/screen/delterm.c
@@ -20,7 +20,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 1997 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -61,21 +61,31 @@ delterm(TERMINAL *terminal)
 	(void) delkeymap(terminal);
 	if (terminal->_check_fd >= 0)
 		(void) close(terminal->_check_fd);
+
+	if (terminal->_pairs_tbl)
+		free(terminal->_pairs_tbl);
+	if (terminal->_color_tbl)
+		free(terminal->_color_tbl);
+#ifdef	_VR3_COMPAT_CODE
+	if (terminal->_acs32map)
+		free(terminal->_acs32map);
+#else	/* _VR3_COMPAT_CODE */
+	if (terminal->_acsmap)
+		free(terminal->_acsmap);
+#endif	/* _VR3_COMPAT_CODE */
+
 	if (terminal == &_first_term) {
 		/* next setupterm can re-use static areas */
 		_called_before = FALSE;
 		if (terminal->_strtab != _frst_tblstr)
-			free((char *)terminal->_strtab);
+			free(terminal->_strtab);
 	} else {
-		free((char *)terminal->_bools);
-		free((char *)terminal->_nums);
-		free((char *)terminal->_strs);
-		free((char *)terminal->_strtab);
-		free((char *)terminal);
+		free(terminal->_bools);
+		free(terminal->_nums);
+		free(terminal->_strs);
+		free(terminal->_strtab);
+		free(terminal);
 	}
-	if (terminal->_pairs_tbl)
-		free((char *) terminal->_pairs_tbl);
-	if (terminal->_color_tbl)
-		free((char *) terminal->_color_tbl);
+
 	return (OK);
 }
diff --git a/usr/src/lib/libcurses/screen/setcurterm.c b/usr/src/lib/libcurses/screen/setcurterm.c
index c1e8ac4e69..8183b61306 100644
--- a/usr/src/lib/libcurses/screen/setcurterm.c
+++ b/usr/src/lib/libcurses/screen/setcurterm.c
@@ -20,7 +20,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 1997 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -55,9 +55,9 @@ setcurterm(TERMINAL *newterminal)
 
 	if (newterminal) {
 #ifdef	_VR3_COMPAT_CODE
-		acs_map = cur_term->_acs32map;
+		acs_map = newterminal->_acs32map;
 #else	/* _VR3_COMPAT_CODE */
-		acs_map = cur_term->_acsmap;
+		acs_map = newterminal->_acsmap;
 #endif	/* _VR3_COMPAT_CODE */
 		cur_bools = newterminal->_bools;
 		cur_nums = newterminal->_nums;
diff --git a/usr/src/lib/libcurses/screen/start_col.c b/usr/src/lib/libcurses/screen/start_col.c
index 1eda194cbd..7a18ef6c94 100644
--- a/usr/src/lib/libcurses/screen/start_col.c
+++ b/usr/src/lib/libcurses/screen/start_col.c
@@ -20,7 +20,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 1997 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -107,16 +107,18 @@ start_color(void)
 		int	i, nc;
 		char	**marks;
 
-		if ((marks = (char **) calloc((unsigned) LINES,
+		if ((marks = (char **)calloc((unsigned)LINES,
 		    sizeof (char *))) == NULL)
 			goto err;
 		SP->_color_mks = marks;
 		nc = (COLS / BITSPERBYTE) + (COLS % BITSPERBYTE ? 1 : 0);
-		if ((*marks = (char *) calloc((unsigned) nc * LINES,
+		if ((*marks = (char *)calloc((unsigned)nc * LINES,
 		    sizeof (char))) == NULL) {
 			free(marks);
 err:			free(color_tbl);
+			cur_term->_color_tbl = NULL;
 err1:			free(cur_term->_pairs_tbl);
+			cur_term->_pairs_tbl = NULL;
 err2:			return (ERR);
 		}
 
diff --git a/usr/src/lib/libcurses/screen/whline.c b/usr/src/lib/libcurses/screen/whline.c
index 0e033d9ae4..be9632cddf 100644
--- a/usr/src/lib/libcurses/screen/whline.c
+++ b/usr/src/lib/libcurses/screen/whline.c
@@ -20,7 +20,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 1997 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -52,8 +52,8 @@ whline(WINDOW *win, chtype horch, int num_chars)
 	if (num_chars <= 0)
 		return (ERR);
 
-	if (num_chars > win->_maxx - curx + 1)
-		num_chars = win->_maxx - curx + 1;
+	if (num_chars > win->_maxx - curx)
+		num_chars = win->_maxx - curx;
 	if (horch == 0)
 		horch = ACS_HLINE;
 	a = _ATTR(horch);
diff --git a/usr/src/lib/libcurses/screen/wvline.c b/usr/src/lib/libcurses/screen/wvline.c
index 0fb238ce2a..e984eee02f 100644
--- a/usr/src/lib/libcurses/screen/wvline.c
+++ b/usr/src/lib/libcurses/screen/wvline.c
@@ -20,7 +20,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 1997 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -49,14 +49,14 @@ wvline(WINDOW *win, chtype vertch, int num_chars)
 {
 	short	cury = win->_cury, curx = win->_curx;
 	chtype  a, **fp = win->_y;
-	short   *firstch = &(win->_firstch[cury]),
-		*lastch = &(win->_lastch[cury]);
+	short   *firstch = &(win->_firstch[cury]);
+	short	*lastch = &(win->_lastch[cury]);
 
 	if (num_chars <= 0)
 		return (ERR);
 
-	if (num_chars > win->_maxy - cury + 1)
-		num_chars = win->_maxy - cury + 1;
+	if (num_chars > win->_maxy - cury)
+		num_chars = win->_maxy - cury;
 	if (vertch == 0)
 		vertch = ACS_VLINE;
 	a = _ATTR(vertch);