Segfault on dereference of NULL-pointer in sys-app/texinfo description.


  The problem is the missing variable initialization in following code snip in session.c

   /* Use KEY (a digit) to select the Nth menu item in WINDOW->node. */
   DECLARE_INFO_COMMAND (info_menu_digit, _("Select this menu item"))
   {
     register int i, item;
[1]  register REFERENCE *entry = NULL, **menu;

     menu = info_menu_of_node (window->node);

     if (!menu)
       {
         info_error ((char *) msg_no_menu_node, NULL, NULL);
         return;
       }

     /* We have the menu.  See if there are this many items in it. */
     item = key - '0';

     /* Special case.  Item "0" is the last item in this menu. */
[2]  if (item == 0)
[3]    for (i = 0; menu[i + 1]; i++);
     else
       {
[4]      for (i = 0; (entry = menu[i]); i++)
           if (i == item - 1)
             break;
       }

[5]  if (menu[i])
       {
         info_select_reference (window, menu[i]);
[6]      if (entry->line_number > 0)
...

  As we can see there is a possible case when item==0 [2] and menu[i]!=NULL [5]. In this case code flows till [6]
 where segfault occurs on the NULL pointer dereference of 'entry', because value of the 'entry' variable still has
 its initial value of NULL[1]. The 'entry' should be initialized at [3] because its meaning is the same as at [4] -
 it is the last member of the 'menu' array and it is used at [6]. 
  So to fix the bug [3] should be changed('entry' initialization):

-    for (i = 0; menu[i + 1]; i++);
+    for (i = 0; (entry=menu[i + 1]); i++);

  And [5] should be changed to 'entry' check:

-    for (i = 0; menu[i + 1]; i++);
+    for (i = 0; (entry=menu[i + 1]); i++);