Description of problem: certian grammars can cause byacc to attempt
to access data off the end of a malloced array.


Version-Release number of selected component (if applicable):1.9


How reproducible:always - grammar dependent.


Steps to Reproduce:
in end_rule() reader.c
when a rule is bugun (reader encounters the : of the rule) end_rule()
is called.  It makes a check to see if this rule returns a value
and if a value is available to return.  However, if we are at the
start of a new rule, the last thing on the pitem stack is a null.
If it happens that this item is also the 300'th item on the stack
(or a multiple of 300) the loop erroneously thinks it is at the
start of a rule with data following and tries to access the 301'st 
element exceeding the array limits.  It appears that the simplest
solution is that end_rule can just check if the last element is a
null and skip this check for a missing default action since the
default action hasn't been entered yet.

 1106,1110c1106,1108
<         if (pitem[nitems-1]) {
<            for (i = nitems - 1; pitem[i]; --i) continue;
<            if (pitem[i+1] == 0 || pitem[i+1]->tag != plhs[nrules]->tag)
<                default_action_warning();
<         }
---
>       for (i = nitems - 1; pitem[i]; --i) continue;
>       if (pitem[i+1] == 0 || pitem[i+1]->tag != plhs[nrules]->tag)
>           default_action_warning();


  
Solution is in the diff above.