This is a backport of the fix itself.

From 643f692bc7b02086e91c2afd12bf9ac8b40b6fe4 Mon Sep 17 00:00:00 2001
From: Jim Meyering <meyering@fb.com>
Date: Thu, 4 Sep 2014 20:52:12 -0700
Subject: [PATCH 12/92] fix "y" to work with NUL in the RHS

* sed/execute.c (do_list) [case 'y']: Handle NUL bytes
in the RHS of a y/LHS/RHS/ transliteration.
* testsuite/y-zero.good: New test-related files.
* testsuite/y-zero.inp:
* testsuite/y-zero.sed:
* testsuite/Makefile.am (SEDTESTS): Add y-zero here.
* testsuite/Makefile.tests: And here.
* NEWS (Bug fixes): Describe it.
The bug was reported by table@inventati.org,
with the execute.c change mostly by Paolo Bonzini.
---
 ChangeLog                |  14 ++++++++++++++
 NEWS                     |  18 +++++++++++++++++-
 sed/execute.c            |   3 ++-
 testsuite/Makefile.am    |   3 ++-
 testsuite/Makefile.tests |   2 +-
 testsuite/y-zero.good    | Bin 0 -> 4 bytes
 testsuite/y-zero.inp     |   1 +
 testsuite/y-zero.sed     |   1 +
 8 files changed, 38 insertions(+), 4 deletions(-)
 create mode 100644 testsuite/y-zero.good
 create mode 100644 testsuite/y-zero.inp
 create mode 100644 testsuite/y-zero.sed

Index: sed-4.2.2/sed/execute.c
===================================================================
--- sed-4.2.2.orig/sed/execute.c
+++ sed-4.2.2/sed/execute.c
@@ -1572,7 +1572,8 @@ execute_program(vec, input)
                            if (strncmp(line.active + idx, trans[2*i], mbclen) == 0)
                              {
                                bool move_remain_buffer = false;
-                               int trans_len = strlen(trans[2*i+1]);
+                               const char *tr = trans[2*i+1];
+                               size_t trans_len = *tr == '\0' ? 1 : strlen (tr);
 
                                if (mbclen < trans_len)
                                  {