uniq: fix read overrun with -w

Problem reported by Michał Majchrowicz.
* src/uniq.c (find_field): Fix typo.
* tests/uniq/uniq.pl (add_z_variants): Test for the bug.

NEWS

@@ -8,6 +8,9 @@ GNU coreutils NEWS                                    -*- outline -*-
   mistakenly exit with a nonzero status.
   [This bug was present in "the beginning".]
 
+  'uniq -w' no longer overruns the read buffer in multibyte locales.
+  [bug introduced in coreutils-9.5]
+
 
 * Noteworthy changes in release 9.11 (2026-04-20) [stable]
 

THANKS.in

@@ -459,6 +459,7 @@ Michail Litvak                      mci@owl.openwall.com
 Michal Politowski                   mpol@charybda.icm.edu.pl
 Michal Svec                         msvec@suse.cz
 Michal Trunecka                     mtruneck@redhat.com
+Michał Majchrowicz                  mmajchrowicz@afine.com
 Michel Robitaille                   robitail@IRO.UMontreal.CA
 Michiel Bacchiani                   bacchian@raven.bu.edu
 Mike Castle                         dalgoda@ix.netcom.com

src/uniq.c

@@ -285,8 +285,8 @@ find_field (struct linebuffer const *line, idx_t *plen)
   else
     {
       char *ep = lp;
-      for (idx_t i = check_chars; 0 < i && lp < lim; i--)
-        ep += mcel_scan (lp, lim).len;
+      for (idx_t i = check_chars; 0 < i && ep < lim; i--)
+        ep += mcel_scan (ep, lim).len;
       len = ep - lp;
     }
 

tests/uniq/uniq.pl

@@ -234,6 +234,9 @@ my @Tests =
         "  - 'separate'\n" .
         "  - 'both'\n" .
         "Try '$prog --help' for more information.\n"}],
+ # Test for read buffer overrun.
+ do { my $longline = "\360\237\230\200" . "A" x 255 . "\n";
+      ['146', '-w256', {IN  => $longline x 2}, {OUT => $longline}] },
 );
 
 # Locale related tests