commit bash-20121221 snapshot

parse.y

@@ -270,9 +270,9 @@ int need_here_doc;
 /* Where shell input comes from.  History expansion is performed on each
    line when the shell is interactive. */
 static char *shell_input_line = (char *)NULL;
-static int shell_input_line_index;
-static int shell_input_line_size;	/* Amount allocated for shell_input_line. */
-static int shell_input_line_len;	/* strlen (shell_input_line) */
+static size_t shell_input_line_index;
+static size_t shell_input_line_size;	/* Amount allocated for shell_input_line. */
+static size_t shell_input_line_len;	/* strlen (shell_input_line) */
 
 /* Either zero or EOF. */
 static int shell_input_line_terminator;
@@ -1601,16 +1601,19 @@ yy_stream_get ()
   result = EOF;
   if (bash_input.location.file)
     {
+#if 0
       if (interactive)
 	interrupt_immediately++;
+#endif
 
       /* XXX - don't need terminate_immediately; getc_with_restart checks
 	 for terminating signals itself if read returns < 0 */
       result = getc_with_restart (bash_input.location.file);
 
+#if 0
       if (interactive)
 	interrupt_immediately--;
-
+#endif
     }
   return (result);
 }
@@ -1795,7 +1798,8 @@ typedef struct string_saver {
 #if defined (ALIAS)
   alias_t *expander;   /* alias that caused this line to be pushed. */
 #endif
-  int saved_line_size, saved_line_index, saved_line_terminator;
+  size_t saved_line_size, saved_line_index;
+  int saved_line_terminator;
 } STRING_SAVER;
 
 STRING_SAVER *pushed_string_list = (STRING_SAVER *)NULL;
@@ -2158,7 +2162,7 @@ shell_getc (remove_quoted_newline)
      int remove_quoted_newline;
 {
   register int i;
-  int c;
+  int c, truncating;
   unsigned char uc;
 
   QUIT;
@@ -2189,12 +2193,21 @@ shell_getc (remove_quoted_newline)
     {
       line_number++;
 
+      /* Let's not let one really really long line blow up memory allocation */
+      if (shell_input_line && shell_input_line_size >= 32768)
+	{
+itrace("shell_getc: freeing shell_input_line");
+	  free (shell_input_line);
+	  shell_input_line = 0;
+	  shell_input_line_size = 0;
+	}
+
     restart_read:
 
       /* Allow immediate exit if interrupted during input. */
       QUIT;
 
-      i = 0;
+      i = truncating = 0;
       shell_input_line_terminator = 0;
 
       /* If the shell is interatctive, but not currently printing a prompt
@@ -2239,7 +2252,30 @@ shell_getc (remove_quoted_newline)
 	      continue;
 	    }
 
-	  RESIZE_MALLOCED_BUFFER (shell_input_line, i, 2, shell_input_line_size, 256);
+	  /* Theoretical overflow */
+	  /* If we can't put 256 bytes more into the buffer, allocate
+	     everything we can and fill it as full as we can. */
+	  /* XXX - we ignore rest of line using `truncating' flag */
+	  if (shell_input_line_size > (SIZE_MAX - 256))
+	    {
+	      size_t n;
+
+	      n = SIZE_MAX - i;	/* how much more can we put into the buffer? */
+	      if (n <= 2)	/* we have to save 1 for the newline added below */
+		{
+		  if (truncating == 0)
+		    internal_warning("shell_getc: shell_input_line_size (%llu) exceeds SIZE_MAX (%llu): line truncated", shell_input_line_size, SIZE_MAX);
+		  shell_input_line[i] = '\0';
+		  truncating = 1;
+		}
+	      if (shell_input_line_size < SIZE_MAX)
+		{
+		  shell_input_line_size = SIZE_MAX;
+		  shell_input_line = xrealloc (shell_input_line, shell_input_line_size);
+		}
+	    }
+	  else
+	    RESIZE_MALLOCED_BUFFER (shell_input_line, i, 2, shell_input_line_size, 256);
 
 	  if (c == EOF)
 	    {
@@ -2253,7 +2289,8 @@ shell_getc (remove_quoted_newline)
 	      break;
 	    }
 
-	  shell_input_line[i++] = c;
+	  if (truncating == 0 || c == '\n')
+	    shell_input_line[i++] = c;
 
 	  if (c == '\n')
 	    {
@@ -2346,7 +2383,7 @@ shell_getc (remove_quoted_newline)
 	 not already end in an EOF character.  */
       if (shell_input_line_terminator != EOF)
 	{
-	  if (shell_input_line_len + 3 > shell_input_line_size)
+	  if (shell_input_line_size < SIZE_MAX && shell_input_line_len > shell_input_line_size - 3)
 	    shell_input_line = (char *)xrealloc (shell_input_line,
 					1 + (shell_input_line_size += 2));
 
@@ -6057,7 +6094,8 @@ restore_input_line_state (ls)
 static void
 set_line_mbstate ()
 {
-  int i, previ, len, c;
+  int c;
+  size_t i, previ, len;
   mbstate_t mbs, prevs;
   size_t mbclen;
 
@@ -6075,7 +6113,7 @@ set_line_mbstate ()
       c = shell_input_line[i];
       if (c == EOF)
 	{
-	  int j;
+	  size_t j;
 	  for (j = i; j < len; j++)
 	    shell_input_line_property[j] = 1;
 	  break;
@@ -6098,7 +6136,7 @@ set_line_mbstate ()
       else
 	{
 	  /* XXX - what to do if mbrlen returns 0? (null wide character) */
-	  int j;
+	  size_t j;
 	  for (j = i; j < len; j++)
 	    shell_input_line_property[j] = 1;
 	  break;