Bus error on backward search

[NIIMI Satoshi <sa2c@xxxxxxxx>]

新見と申します。

Emacs 22.0.90 にて、マルチバイト文字を含む長い文字列を search-backward
するとバスエラーを起こします。

環境は FreeBSD/i386 6.1、Emacs は --with-gtk でコンパイルしています。

現象が起きたときのバックトレース等の抜粋は以下のとおりです。

this_pos_byte が負になっているのがよくなさそうなので、添付のパッチのよう
に変更したところ落ちなくはなりました。

Program received signal SIGSEGV, Segmentation fault.
0x081213c5 in simple_search (n=-1, pat=0xbfbfd650, len=665,
len_byte=875, trt=139821060, pos=851, pos_byte=851, lim=1, lim_byte=1)
at /home/sa2c/work/emacs/src/search.c:1526
(gdb) p this_pos_byte
$1 = -24
(gdb) bt
#0  0x081213c5 in simple_search (n=-1, pat=0xbfbfd650, len=665,
len_byte=875, trt=139821060, pos=851, pos_byte=851, lim=1, lim_byte=1)
at /home/sa2c/work/emacs/src/search.c:1526
#1  0x08121033 in search_buffer (string=10, pos=3928, pos_byte=4418,
lim=1, lim_byte=1, n=-1, RE=0, trt=139821060, inverse_trt=139823108,
posix=0) at /home/sa2c/work/emacs/src/search.c:1390
#2  0x081207d2 in search_command (string=146768723, bound=689123352,
noerror=137418801, count=137369096, direction=-1, RE=0, posix=0) at
/home/sa2c/work/emacs/src/search.c:977
#3  0x08122789 in Fsearch_backward (string=146768723, bound=137418753,
noerror=137418801, count=137418753) at
/home/sa2c/work/emacs/src/search.c:2161
...
Lisp Backtrace:
"search-backward" (0x8bf8353)
"diff-find-text" (0x8bf8353)
"diff-find-source-location" (0x8bd9283)
"diff-current-defun" (0x14)
"byte-code" (0x8bd01e3)
"add-log-current-defun" (0x0)
"ad-Orig-add-change-log-entry" (0x830d801)
"add-change-log-entry" (0x830d801)
"add-change-log-entry-other-window" (0x830d801)
"call-interactively" (0x8376819)
-- 
NIIMI Satoshi / 新見 覚志

Index: src/search.c
===================================================================
RCS file: /sources/emacs/emacs/src/search.c,v
retrieving revision 1.217
diff -u -c -r1.217 search.c
*** src/search.c	3 Oct 2006 13:47:26 -0000	1.217
--- src/search.c	1 Nov 2006 08:59:04 -0000
***************
*** 1514,1520 ****
  	    int this_len_byte = len_byte;
  	    unsigned char *p = pat;
  
! 	    if (pos - len < lim)
  	      goto stop;
  
  	    while (this_len > 0)
--- 1514,1520 ----
  	    int this_len_byte = len_byte;
  	    unsigned char *p = pat;
  
! 	    if (this_pos < lim || this_pos_byte < lim_byte)
  	      goto stop;
  
  	    while (this_len > 0)