--- src/rcs.c	2008/05/07 15:34:16	1.262.4.65
+++ src/rcs.c	2010/10/21 13:24:15	1.262.4.66
@@ -7128,7 +7128,7 @@
     struct deltafrag *dfhead;
     struct deltafrag **dftail;
     struct deltafrag *df;
-    unsigned long numlines, lastmodline, offset;
+    unsigned long numlines, offset;
     struct linevector lines;
     int err;
 
@@ -7202,12 +7202,12 @@
 
     /* New temp data structure to hold new org before
        copy back into original structure. */
-    lines.nlines = lines.lines_alloced = numlines;
+    lines.lines_alloced = numlines;
     lines.vector = xmalloc (numlines * sizeof *lines.vector);
 
     /* We changed the list order to first to last -- so the
        list never gets larger than the size numlines. */
-    lastmodline = 0; 
+    lines.nlines = 0; 
 
     /* offset created when adding/removing lines
        between new and original structure */
@@ -7216,25 +7216,24 @@
     for (df = dfhead; df != NULL; )
     {
 	unsigned int ln;
-	unsigned long deltaend;
+	unsigned long newpos = df->pos - offset;
 
-	if (df->pos > orig_lines->nlines)
+	if (newpos < lines.nlines || newpos > numlines)
 	    err = 1;
 
 	/* On error, just free the rest of the list.  */
 	if (!err)
 	{
-	    /* Here we need to get to the line where the next insert will
+	    /* Here we need to get to the line where the next change will
 	       begin, which is DF->pos in ORIG_LINES.  We will fill up to
 	       DF->pos - OFFSET in LINES with original items.  */
-	    for (deltaend = df->pos - offset;
-		 lastmodline < deltaend;
-		 lastmodline++)
+	    while (lines.nlines < newpos)
 	    {
 		/* we need to copy from the orig structure into new one */
-		lines.vector[lastmodline] =
-			orig_lines->vector[lastmodline + offset];
-		lines.vector[lastmodline]->refcount++;
+		lines.vector[lines.nlines] =
+			orig_lines->vector[lines.nlines + offset];
+		lines.vector[lines.nlines]->refcount++;
+		lines.nlines++;
 	    }
 
 	    switch (df->type)
@@ -7246,7 +7245,12 @@
 		    struct line *q;
 		    int nextline_newline;
 		    size_t nextline_len;
-		
+
+		    if (newpos + df->nlines > numlines)
+		    {
+			err = 1;
+			break;
+		    }
 		    textend = df->new_lines + df->len;
 		    nextline_newline = 0;
 		    nextline_text = df->new_lines;
@@ -7271,8 +7275,7 @@
 			    q->has_newline = nextline_newline;
 			    q->refcount = 1;
 			    memcpy (q->text, nextline_text, nextline_len);
-			    lines.vector[lastmodline++] = q;
-			    offset--;
+			    lines.vector[lines.nlines++] = q;
 		    
 			    nextline_text = (char *)p + 1;
 			    nextline_newline = 0;
@@ -7286,11 +7289,11 @@
 		    q->has_newline = nextline_newline;
 		    q->refcount = 1;
 		    memcpy (q->text, nextline_text, nextline_len);
-		    lines.vector[lastmodline++] = q;
+		    lines.vector[lines.nlines++] = q;
 
 		    /* For each line we add the offset between the #'s
 		       decreases. */
-		    offset--;
+		    offset -= df->nlines;
 		    break;
 		}
 
@@ -7301,14 +7304,20 @@
 		    if (df->pos + df->nlines > orig_lines->nlines)
 			err = 1;
 		    else if (delvers)
+		    {
 			for (ln = df->pos; ln < df->pos + df->nlines; ++ln)
+			{
 			    if (orig_lines->vector[ln]->refcount > 1)
+			    {
 				/* Annotate needs this but, since the original
 				 * vector is disposed of before returning from
 				 * this function, we only need keep track if
 				 * there are multiple references.
 				 */
 				orig_lines->vector[ln]->vers = delvers;
+			    }
+			}
+		    }
 		    break;
 	    }
 	}
@@ -7328,21 +7337,20 @@
     else
     {
 	/* add the rest of the remaining lines to the data vector */
-	for (; lastmodline < numlines; lastmodline++)
+	while (lines.nlines < numlines)
 	{
 	    /* we need to copy from the orig structure into new one */
-	    lines.vector[lastmodline] = orig_lines->vector[lastmodline
+	    lines.vector[lines.nlines] = orig_lines->vector[lines.nlines
 							   + offset];
-	    lines.vector[lastmodline]->refcount++;
+	    lines.vector[lines.nlines]->refcount++;
+	    lines.nlines++;
 	}
 
 	/* Move the lines vector to the original structure for output,
 	 * first deleting the old.
 	 */
 	linevector_free (orig_lines);
-	orig_lines->vector = lines.vector;
-	orig_lines->lines_alloced = numlines;
-	orig_lines->nlines = lines.nlines;
+	*orig_lines = lines;
     }
 
     return !err;