commit bash-snap-20170616 snapshot

lib/readline/display.c

@@ -467,6 +467,7 @@ expand_prompt (char *pmt, int flags, int *lp, int *lip, int *niflp, int *vlp)
 	      if (physchars > bound)		/* should rarely happen */
 		{
 #if defined (HANDLE_MULTIBYTE)
+		  *r = '\0';	/* need null-termination for strlen */
 		  if (mb_cur_max > 1 && rl_byte_oriented == 0)
 		    new = _rl_find_prev_mbchar (ret, r - ret, MB_FIND_ANY);
 		  else
@@ -1518,6 +1519,8 @@ update_line (char *old, char *new, int current_line, int omax, int nmax, int inv
 	    oldwidth = 0;
 	  else
 	    oldwidth = WCWIDTH (wc);
+	  if (oldwidth < 0)
+	    oldwidth = 1;
 
 	  /* 2. how many screen positions does the first char in new consume? */
 	  memset (&ps, 0, sizeof (mbstate_t));
@@ -1532,12 +1535,16 @@ update_line (char *old, char *new, int current_line, int omax, int nmax, int inv
 	    newwidth = 0;
 	  else
 	    newwidth = WCWIDTH (wc);
+	  if (newwidth < 0)
+	    newwidth = 1;
 
 	  /* 3. if the new width is less than the old width, we need to keep
 	     going in new until we have consumed at least that many screen
 	     positions, and figure out how many bytes that will take */
 	  while (newbytes < nmax && newwidth < oldwidth)
 	    {
+	      int t;
+
 	      ret = mbrtowc (&wc, new+newbytes, mb_cur_max, &ps);
 	      if (MB_INVALIDCH (ret))
 		{
@@ -1548,7 +1555,8 @@ update_line (char *old, char *new, int current_line, int omax, int nmax, int inv
 	        break;
 	      else
 		{
-		  newwidth += WCWIDTH (wc);
+		  t = WCWIDTH (wc);
+		  newwidth += (t >= 0) ? t : 1;
 		  newbytes += ret;
 		}
 	    }
@@ -1557,6 +1565,8 @@ update_line (char *old, char *new, int current_line, int omax, int nmax, int inv
 	     figure out how many bytes that will take.  This is an optimization */
 	  while (oldbytes < omax && oldwidth < newwidth)
 	    {
+	      int t;
+
 	      ret = mbrtowc (&wc, old+oldbytes, mb_cur_max, &ps);
 	      if (MB_INVALIDCH (ret))
 		{
@@ -1567,7 +1577,8 @@ update_line (char *old, char *new, int current_line, int omax, int nmax, int inv
 	        break;
 	      else
 		{
-		  oldwidth += WCWIDTH (wc);
+		  t = WCWIDTH (wc);
+		  oldwidth += (t >= 0) ? t : 1;
 		  oldbytes += ret;
 		}
 	    }

lib/readline/isearch.c

@@ -262,7 +262,7 @@ static void
 _rl_isearch_fini (_rl_search_cxt *cxt)
 {
   /* First put back the original state. */
-  strcpy (rl_line_buffer, cxt->lines[cxt->save_line]);
+  rl_replace_line (cxt->lines[cxt->save_line], 0);
 
   rl_restore_prompt ();
 
@@ -292,6 +292,7 @@ _rl_isearch_fini (_rl_search_cxt *cxt)
   rl_point = cxt->sline_index;
   /* Don't worry about where to put the mark here; rl_get_previous_history
      and rl_get_next_history take care of it. */
+  _rl_fix_point (0);
 
   rl_clear_message ();
 }
@@ -515,7 +516,7 @@ add_character:
 	    }
 	  return (1);
 	}
-      else if (cxt->sflags & SF_REVERSE)
+      else if (cxt->sflags & SF_REVERSE && cxt->sline_index > 0)
 	cxt->sline_index--;
       else if (cxt->sline_index != cxt->sline_len)
 	cxt->sline_index++;
@@ -664,6 +665,11 @@ add_character:
 	    }
 	  else
 	    cxt->sline_index += cxt->direction;
+	  if (cxt->sline_index < 0)
+	    {
+	      cxt->sline_index = 0;
+	      break;
+	    }
 	}
       if (cxt->sflags & SF_FOUND)
 	break;

lib/readline/kill.c

@@ -119,7 +119,7 @@ _rl_copy_to_kill_ring (char *text, int append)
 	  else
 	    {
 	      slot = rl_kill_ring_length += 1;
-	      rl_kill_ring = (char **)xrealloc (rl_kill_ring, slot * sizeof (char *));
+	      rl_kill_ring = (char **)xrealloc (rl_kill_ring, (slot + 1) * sizeof (char *));
 	    }
 	  rl_kill_ring[--slot] = (char *)NULL;
 	}

lib/readline/mbutil.c

@@ -92,6 +92,11 @@ _rl_find_next_mbchar_internal (char *string, int seed, int count, int find_non_z
     return seed;
 
   point = seed + _rl_adjust_point (string, seed, &ps);
+  /* if _rl_adjust_point returns -1, the character or string is invalid.
+     treat as a byte. */
+  if (point == seed - 1)	/* invalid */
+    return seed + 1;
+    
   /* if this is true, means that seed was not pointing to a byte indicating
      the beginning of a multibyte character.  Correct the point and consume
      one char. */
@@ -265,7 +270,7 @@ _rl_compare_chars (char *buf1, int pos1, mbstate_t *ps1, char *buf2, int pos2, m
 /* adjust pointed byte and find mbstate of the point of string.
    adjusted point will be point <= adjusted_point, and returns
    differences of the byte(adjusted_point - point).
-   if point is invalied (point < 0 || more than string length),
+   if point is invalid (point < 0 || more than string length),
    it returns -1 */
 int
 _rl_adjust_point (char *string, int point, mbstate_t *ps)
@@ -336,6 +341,8 @@ _rl_char_value (char *buf, int ind)
   l = strlen (buf);
   if (ind >= l - 1)
     return ((wchar_t) buf[ind]);
+  if (l < ind)			/* Sanity check */
+    l = strlen (buf+ind);
   memset (&ps, 0, sizeof (mbstate_t));
   tmp = mbrtowc (&wc, buf + ind, l - ind, &ps);
   if (MB_INVALIDCH (tmp) || MB_NULLWCH (tmp))  

lib/readline/util.c

@@ -193,7 +193,7 @@ rl_tilde_expand (int ignore, int key)
     }
   else if (start >= 0 && rl_line_buffer[start] != '~')
     {
-      for (; !whitespace (rl_line_buffer[start]) && start >= 0; start--)
+      for (; start >= 0 && !whitespace (rl_line_buffer[start]); start--)
         ;
       start++;
     }