From 0dcc9c6ca76403901e7e5b9df45d2d1f4ef69bc6 Mon Sep 17 00:00:00 2001
From: Tim Edwards <tim@opencircuitdesign.com>
Date: Sat, 24 Apr 2021 22:13:30 -0400
Subject: [PATCH] Corrected two potentially fatal errors:  (1) Code doing the
 PDK_PATH and HOME substitution in filenames needs to watch for a NULL
 cd_file, and (2) The routine that removes the (UNNAMED) cell when another
 cell is loaded needs to NULL the boxRootDef pointer or else it ends up
 pointing to deallocated memory.

---
 VERSION               |  2 +-
 database/DBcellname.c |  3 +--
 database/DBio.c       |  4 +++-
 dbwind/DBWtools.c     | 25 +++++++++++++++++++++++++
 dbwind/dbwind.h       |  1 +
 5 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/VERSION b/VERSION
index 8be00eea..4c5af339 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-8.3.157
+8.3.158
diff --git a/database/DBcellname.c b/database/DBcellname.c
index b19ad2fc..e6ee0b14 100644
--- a/database/DBcellname.c
+++ b/database/DBcellname.c
@@ -273,6 +273,7 @@ DBCellDelete(cellname, force)
     }
     celldef->cd_parents = (CellUse *)NULL;
 
+    DBWResetBox(celldef);
     result = DBCellDeleteDef(celldef);
 
     if (result == FALSE)
@@ -282,8 +283,6 @@ DBCellDelete(cellname, force)
     return result;
 }
 
-
-
 /*
  * ----------------------------------------------------------------------------
  *
diff --git a/database/DBio.c b/database/DBio.c
index 3bbfbec1..2b0e2a2f 100644
--- a/database/DBio.c
+++ b/database/DBio.c
@@ -3494,7 +3494,9 @@ DBPathSubstitute(pathstart, cstring, cellDef)
 
 	char *homedir = getenv("HOME");
 
-	if (!strncmp(cellDef->cd_file, homedir, strlen(homedir))
+	if (cellDef->cd_file == NULL)
+	    sprintf(cstring, "%s", pathstart);
+	else if (!strncmp(cellDef->cd_file, homedir, strlen(homedir))
 			&& (*(cellDef->cd_file + strlen(homedir)) == '/'))
 	    sprintf(cstring, "~%s", cellDef->cd_file + strlen(homedir));
 	else
diff --git a/dbwind/DBWtools.c b/dbwind/DBWtools.c
index 12c5270b..31df5c9a 100644
--- a/dbwind/DBWtools.c
+++ b/dbwind/DBWtools.c
@@ -790,6 +790,31 @@ DBWSetBox(rootDef, rect)
     dbwRecordBoxArea(FALSE);
 }
 
+/*
+ * ----------------------------------------------------------------------------
+ * DBWResetBox() ---
+ *
+ *	Make sure that boxRootDef is set to NULL if it is equal to the
+ *	specified CellDef.  This is used by the cell delete function to
+ *	make sure that if an edit cell is deleted, the boxRootDef is not
+ *	pointing to an invalid area of memory.
+ *
+ * Results:
+ *	None.
+ *
+ * Side effects:
+ *	Global variable boxRootDef may be set to NULL.
+ *
+ * ----------------------------------------------------------------------------
+ */
+
+void
+DBWResetBox(CellDef *def)
+{
+    if (def == boxRootDef)
+	boxRootDef = NULL;
+}
+
 /*
  * ----------------------------------------------------------------------------
  *	ToolMoveBox --
diff --git a/dbwind/dbwind.h b/dbwind/dbwind.h
index d9cabed8..f77f469f 100644
--- a/dbwind/dbwind.h
+++ b/dbwind/dbwind.h
@@ -189,6 +189,7 @@ extern void ToolMoveBox(), ToolMoveCorner();
 extern int ToolGetCorner();
 extern void DBWloadWindow(), DBWxloadWindow();
 extern void DBWSetBox();
+extern void DBWResetBox();
 extern void DBWUndoOldEdit();
 extern void DBWUndoNewEdit();