This patch originates from the Debian project, see https://www.debian.org/ 29file_backup.dpatch by Save the intermediate CHAR2INT conversion pointer because that pointer is reused by later conversions in calls below. --- nvi-1.81.6.orig/common/exf.c 2009-07-24 11:30:05.962060755 +0200 +++ nvi-1.81.6/common/exf.c 2009-07-24 12:09:57.511311177 +0200 @@ -1092,8 +1092,8 @@ size_t blen; int flags, maxnum, nr, num, nw, rfd, wfd, version; char *bp, *estr, *p, *pct, *slash, *t, *wfname, buf[8192]; - CHAR_T *wp; - size_t wlen; + CHAR_T *wp, *wp2; + size_t wlen, wlen2; size_t nlen; char *d = NULL; @@ -1148,8 +1148,13 @@ } else version = 0; CHAR2INT(sp, bname, strlen(bname) + 1, wp, wlen); - if (argv_exp2(sp, &cmd, wp, wlen - 1)) + GET_SPACE_RETW(sp, wp2, wlen2, wlen); + MEMCPY(wp2, wp, wlen); + if (argv_exp2(sp, &cmd, wp2, wlen2 - 1)) { + FREE_SPACEW(sp, wp2, wlen2); return (1); + } + FREE_SPACEW(sp, wp2, wlen2); /* * 0 args: impossible.