utils/bash/patches/109-upstream-bash43-009.patch

   1                              BASH PATCH REPORT
   2                              =================
   3
   4 Bash-Release:   4.3
   5 Patch-ID:       bash43-009
   6
   7 Bug-Reported-by:        Matthias Klose <doko@debian.org>
   8 Bug-Reference-ID:       <53346FC8.6090005@debian.org>
   9 Bug-Reference-URL:      http://lists.gnu.org/archive/html/bug-bash/2014-03/msg00171.html
  10
  11 Bug-Description:
  12
  13 There is a problem with unsigned sign extension when attempting to reallocate
  14 the input line when it is fewer than 3 characters long and there has been a
  15 history expansion.  The sign extension causes the shell to not reallocate the
  16 line, which results in a segmentation fault when it writes past the end.
  17
  18 Patch (apply with `patch -p0'):
  19
  20 --- a/parse.y
  21 +++ b/parse.y
  22 @@ -2424,7 +2424,7 @@ shell_getc (remove_quoted_newline)
  23          not already end in an EOF character.  */
  24        if (shell_input_line_terminator != EOF)
  25         {
  26 -         if (shell_input_line_size < SIZE_MAX && shell_input_line_len > shell_input_line_size - 3)
  27 +         if (shell_input_line_size < SIZE_MAX-3 && (shell_input_line_len+3 > shell_input_line_size))
  28             shell_input_line = (char *)xrealloc (shell_input_line,
  29                                         1 + (shell_input_line_size += 2));
  30
  31 --- a/y.tab.c
  32 +++ b/y.tab.c
  33 @@ -4736,7 +4736,7 @@ shell_getc (remove_quoted_newline)
  34          not already end in an EOF character.  */
  35        if (shell_input_line_terminator != EOF)
  36         {
  37 -         if (shell_input_line_size < SIZE_MAX && shell_input_line_len > shell_input_line_size - 3)
  38 +         if (shell_input_line_size < SIZE_MAX-3 && (shell_input_line_len+3 > shell_input_line_size))
  39             shell_input_line = (char *)xrealloc (shell_input_line,
  40                                         1 + (shell_input_line_size += 2));
  41
  42 --- a/patchlevel.h
  43 +++ b/patchlevel.h
  44 @@ -25,6 +25,6 @@
  45     regexp `^#define[   ]*PATCHLEVEL', since that's what support/mkversion.sh
  46     looks for to find the patch level (for the sccs version string). */
  47
  48 -#define PATCHLEVEL 8
  49 +#define PATCHLEVEL 9
  50
  51  #endif /* _PATCHLEVEL_H_ */