RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

The data type is:

typedef struct char_str {
#define	CS_NORMAL	1
#define	CS_ALTERNATE	2
	short		c_column;	/* column character is in */
	CSET		c_set;		/* character set (currently only 2) */
	wchar_t		c_char;		/* character in question */
	int		c_width;	/* character width */
} CHAR;

and the c_column field is set from the variable:

	int cur_col;			/* current column */

  Apparently the reproducer file was lost, but upon the proper
input, it will execute in flush_line():

		for (i = nchars, c = l->l_line; --i >= 0; c++)
			count[c->c_column]++;

and c->c_column might be negative, as is in a sample coredump:

(gdb) p *c
$1 = {c_column = -32760, c_set = 1 '\001', c_char = 56 L'8', c_width = 1}

if it were unsigned, the crash would not happen, as it would
be guaranteed to be positive and less than l->l_max_col.

(gdb) p *l
$2 = {l_line = 0x7fde4a203010, l_prev = 0x1397878, l_next = 0x0, l_lsize = 11520, l_line_len = 10033, l_needs_sort = 1, l_max_col = 65984}

l->l_max_col is of type int, so, for safety it could be a good
idea to also make it unsigned, besides unlikely to have col input
with 2G columns on a line.

Already fixed upstream:

commit 004356f05018e3bfcaddd2652846659a4d8481f3
Author: Karel Zak <kzak>
Date:   Tue Feb 5 12:06:00 2019 +0100

    col: make flush_line() a little bit robust
    
    The code is horrible. The core of the problem are signed integers
    and no check for the limits.
    
    This patch fixes c->c_column = cur_col; where c_column is "short"
    and "cur_col" is int. Let's use "int" for all the variables. It's
    really not perfect as for bigger lines it can segfault again...
    
    The patch also removes some unnecessary static variables.
    
    Addresses: https://github.com/karelzak/util-linux/issues/749
    Signed-off-by: Karel Zak <kzak>

I do not see problem to backport the patch to RHEL-7.9 and RHEL-8.3  (it's probably too late for 8.2).

I'll clone it for RHEL-8.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (util-linux bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:3963