diff --git a/CWRU/CWRU.chlog b/CWRU/CWRU.chlog
index 54b55a50..36fa8ee5 100644
--- a/CWRU/CWRU.chlog
+++ b/CWRU/CWRU.chlog
@@ -5707,3 +5707,21 @@ parse.y
 	- read_token: if we return a newline, make sure we call set_word_top()
 	  if necessary.
 	  Fixes underflow reported by Grisha Levit <grishalevit@gmail.com>
+
+lib/glob/sm_loop.c
+	- EXTMATCH: don't bother with FNM_PATHNAME checks; this function isn't
+	  called with a pathname.
+	  Fixes underflow reported by Grisha Levit <grishalevit@gmail.com>
+
+lib/readline/misc.c
+	- rl_maybe_replace_line: if we replace a history entry's data with
+	  rl_undo_list, we need to set rl_undo_list to 0, since we should not
+	  have rl_undo_list pointing to something from a history entry
+	  Fixes asan error reported by Grisha Levit <grishalevit@gmail.com>
+
+				   3/20
+				   ----
+lib/readline/histexpand.c
+	- postproc_subst_rhs: fix off-by-one error when reallocating new string
+	  for case where we're *not* substituting for `&'
+	  Fixes asan error reported by Grisha Levit <grishalevit@gmail.com>
diff --git a/doc/bashref.texi b/doc/bashref.texi
index 4d1afa83..1786ce37 100644
--- a/doc/bashref.texi
+++ b/doc/bashref.texi
@@ -7528,6 +7528,11 @@ equal-precedence operators.
 The levels are listed in order of decreasing precedence. 
 
 @table @code
+@cindex arithmetic operators
+@cindex unary arithmetic operators
+@cindex binary arithmetic operators
+@cindex conditional arithmetic operator
+@cindex bitwise arithmetic operators
 
 @item @var{id}++ @var{id}--
 variable post-increment and post-decrement 
@@ -7574,7 +7579,7 @@ logical AND
 @item ||
 logical OR
 
-@item expr ? expr : expr
+@item expr ? if-true-expr : if-false-expr
 conditional operator
 
 @item = *= /= %= += -= <<= >>= &= ^= |=
diff --git a/lib/glob/sm_loop.c b/lib/glob/sm_loop.c
index 01910805..303e1f0c 100644
--- a/lib/glob/sm_loop.c
+++ b/lib/glob/sm_loop.c
@@ -907,9 +907,7 @@ fprintf(stderr, "extmatch: flags = %d\n", flags);
 	  if (m1 == 0 && (flags & FNM_PERIOD) && *s == '.')
 	    return (FNM_NOMATCH);
 
-	  if (m1 == 0 && (flags & FNM_DOTDOT) &&
-	      (SDOT_OR_DOTDOT (s) ||
-	       ((flags & FNM_PATHNAME) && s[-1] == L('/') && PDOT_OR_DOTDOT(s))))
+	  if (m1 == 0 && (flags & FNM_DOTDOT) && (SDOT_OR_DOTDOT (s)))
 	    return (FNM_NOMATCH);
 
 	  /* if srest > s, we are not at start of string */
diff --git a/lib/readline/histexpand.c b/lib/readline/histexpand.c
index 25d962c2..d21240bf 100644
--- a/lib/readline/histexpand.c
+++ b/lib/readline/histexpand.c
@@ -509,7 +509,7 @@ postproc_subst_rhs (void)
 	  /* a single backslash protects the `&' from lhs interpolation */
 	  if (subst_rhs[i] == '\\' && subst_rhs[i + 1] == '&')
 	    i++;
-	  if (j >= new_size)
+	  if (j + 1 >= new_size)
 	    new = (char *)xrealloc (new, new_size *= 2);
 	  new[j++] = subst_rhs[i];
 	}
diff --git a/lib/readline/misc.c b/lib/readline/misc.c
index c797ff74..764482a0 100644
--- a/lib/readline/misc.c
+++ b/lib/readline/misc.c
@@ -340,6 +340,10 @@ rl_maybe_replace_line (void)
       xfree (temp->line);
       FREE (temp->timestamp);
       xfree (temp);
+      /* Do we want to set rl_undo_list = 0 here since we just saved it into
+	 a history entry? */
+      rl_undo_list = 0;
+
       /* XXX - what about _rl_saved_line_for_history? if the saved undo list
 	 is rl_undo_list, and we just put that into a history entry, should
 	 we set the saved undo list to NULL? */