Bug 1784579

The data type is:

typedef struct char_str {
#define	CS_NORMAL	1
#define	CS_ALTERNATE	2
	short		c_column;	/* column character is in */
	CSET		c_set;		/* character set (currently only 2) */
	wchar_t		c_char;		/* character in question */
	int		c_width;	/* character width */
} CHAR;

and the c_column field is set from the variable:

	int cur_col;			/* current column */

  Apparently the reproducer file was lost, but upon the proper
input, it will execute in flush_line():

		for (i = nchars, c = l->l_line; --i >= 0; c++)
			count[c->c_column]++;

and c->c_column might be negative, as is in a sample coredump:

(gdb) p *c
$1 = {c_column = -32760, c_set = 1 '\001', c_char = 56 L'8', c_width = 1}

if it were unsigned, the crash would not happen, as it would
be guaranteed to be positive and less than l->l_max_col.

(gdb) p *l
$2 = {l_line = 0x7fde4a203010, l_prev = 0x1397878, l_next = 0x0, l_lsize = 11520, l_line_len = 10033, l_needs_sort = 1, l_max_col = 65984}

l->l_max_col is of type int, so, for safety it could be a good
idea to also make it unsigned, besides unlikely to have col input
with 2G columns on a line.