commit bash-20180713 snapshot

CWRU/CWRU.chlog

@@ -3924,3 +3924,63 @@ lib/readline/doc/hstech.texi
 	- history_quoting_state: describe effect of setting this variable
 	- history_quotes_inihibit_expansion: expand the description to include
 	  the default quoting behavior that setting this variable enables
+
+				    7/9
+				    ---
+support/man2html.c
+	- unescape: use memmove instead of strcpy to handle overlapping strings
+	  Report and fix from Bernhard M. Wiedemann <bwiedemann@suse.de>
+
+lib/sh/getenv.c
+	- getenv: check that environ is non-NULL before looking through it.
+	  Report and fix from Keeley Hoek <keeley@hoek.io>
+
+				   7/12
+				   ----
+braces.c
+	- mkseq: use better integer overflow handling for systems with 32-bit
+	  ints and 64-bit intmax_ts. Bug reported by Simon W枚rner
+	  <mail@simon-woerner.de> as the result of fuzzing
+
+builtins/declare.def
+	- declare_internal: make sure bind_variable returns non-NULL when
+	  setting attributes for a variable named as an argument to declare
+	  that also appears in the temporary environment (and is a nameref).
+	  Bug reported by Simon W枚rner <mail@simon-woerner.de as the
+	  result of fuzzing
+
+variables.c
+	- bind_variable_internal: if we're assigning through a nameref, don't
+	  create a variable with an invalid name under any circumstances
+
+builtins/common.c
+	- get_job_spec: make sure to return NO_JOB if atoi() returns < 0 due
+	  to integer overflow.
+	  Bug reported by Simon W枚rner <mail@simon-woerner.de as the
+	  result of fuzzing
+
+				   7/13
+				   ----
+execute_cmd.c
+	- execute_in_subshell: don't call set_sigint_handler if the subshell
+	  is asynchronous, since it undoes the signal handler installed by
+	  setup_async_signals. Fixes bug reported by Daniel Mills
+	  <danielmills1@gmail.com>
+
+parse.y,externs.h
+	- reset_readahead_token: new convenience function for the rest of
+	  the shell, resets token_to_read if it's a newline (as it will be
+	  after reset_parser is called)
+
+eval.c
+	- reader_loop: if we're just going to execute one command, make sure
+	  the read-ahead token isn't set to something that will result in a
+	  NULL command (by calling reset_readahead_token), since the code
+	  will take that as the one command and set EOF_Reached
+
+				   7/15
+				   ----
+doc/{bash.1,bashref.texi}
+	- indirect expansion: clarify that the expansion works on parameters,
+	  not just variables (NAMEs). Suggested by konsolebox
+	  <konsolebox@gmail.com>

braces.c

@@ -420,9 +420,9 @@ mkseq (start, end, incr, type, width)
   /* Instead of a simple nelem = prevn + 1, something like:
   	nelem = (prevn / imaxabs(incr)) + 1;
      would work */
-  nelem = (prevn / sh_imaxabs(incr)) + 1;
-  if (nelem > INT_MAX - 2)		/* Don't overflow int */
+  if ((prevn / sh_imaxabs (incr)) > INT_MAX - 3)	/* check int overflow */
     return ((char **)NULL);
+  nelem = (prevn / sh_imaxabs(incr)) + 1;
   result = strvec_mcreate (nelem + 1);
   if (result == 0)
     {

builtins/common.c

@@ -678,7 +678,7 @@ get_job_spec (list)
   if (DIGIT (*word) && all_digits (word))
     {
       job = atoi (word);
-      return (job > js.j_jobslots ? NO_JOB : job - 1);
+      return ((job < 0 || job > js.j_jobslots) ? NO_JOB : job - 1);
     }
 
   jflags = 0;

builtins/declare.def

@@ -939,9 +939,12 @@ restart_new_var_name:
 		{
 		  tvalue = var_isset (var) ? savestring (value_cell (var)) : savestring ("");
 	          tv = bind_variable (var->name, tvalue, 0);
-	          tv->attributes |= var->attributes & ~att_tempvar;
-	          if (tv->context > 0)
-		    VSETATTR (tv, att_propagate);
+		  if (tv)
+		    {
+		      tv->attributes |= var->attributes & ~att_tempvar;
+		      if (tv->context > 0)
+			VSETATTR (tv, att_propagate);
+		    }
 	          free (tvalue);
 		}
 	      VSETATTR (var, att_propagate);

doc/bash.1

@@ -739,7 +739,7 @@ to be matched as a string.
 An additional binary operator, \fB=~\fP, is available, with the same
 precedence as \fB==\fP and \fB!=\fP.
 When it is used, the string to the right of the operator is considered
-an extended regular expression and matched accordingly (as in \fIregex\fP(3)).
+a POSIX extended regular expression and matched accordingly (as in \fIregex\fP(3)).
 The return value is 0 if the string matches
 the pattern, and 1 otherwise.
 If the regular expression is syntactically incorrect, the conditional
@@ -2954,16 +2954,16 @@ The \fIparameter\fP is a shell parameter as described above
 .PP
 If the first character of \fIparameter\fP is an exclamation point (\fB!\fP),
 and \fIparameter\fP is not a \fInameref\fP,
-it introduces a level of variable indirection.
-\fBBash\fP uses the value of the variable formed from the rest of
-\fIparameter\fP as the name of the variable; this variable is then
-expanded and that value is used in the rest of the substitution, rather
-than the value of \fIparameter\fP itself.
+it introduces a level of indirection.
+\fBBash\fP uses the value formed by expanding the rest of
+\fIparameter\fP as the new \fIparameter\fP; this is then
+expanded and that value is used in the rest of the expansion, rather
+than the expansion of the original \fIparameter\fP.
 This is known as \fIindirect expansion\fP.
 The value is subject to tilde expansion,
 parameter expansion, command substitution, and arithmetic expansion.
 If \fIparameter\fP is a nameref, this expands to the name of the
-variable referenced by \fIparameter\fP instead of performing the
+parameter referenced by \fIparameter\fP instead of performing the
 complete indirect expansion.
 The exceptions to this are the expansions of ${\fB!\fP\fIprefix\fP\fB*\fP} and
 ${\fB!\fP\fIname\fP[\fI@\fP]} described below.

doc/bashref.texi

@@ -1030,7 +1030,8 @@ to be matched as a string.
 An additional binary operator, @samp{=~}, is available, with the same
 precedence as @samp{==} and @samp{!=}.
 When it is used, the string to the right of the operator is considered
-an extended regular expression and matched accordingly (as in @i{regex}3)).
+a @sc{POSIX} extended regular expression and matched accordingly
+(as in @i{regex}3)).
 The return value is 0 if the string matches
 the pattern, and 1 otherwise.
 If the regular expression is syntactically incorrect, the conditional
@@ -1973,11 +1974,11 @@ interpreted as part of its name.
 
 If the first character of @var{parameter} is an exclamation point (!),
 and @var{parameter} is not a @var{nameref},
-it introduces a level of variable indirection.
-Bash uses the value of the variable formed from the rest of
-@var{parameter} as the name of the variable; this variable is then
-expanded and that value is used in the rest of the substitution, rather
-than the value of @var{parameter} itself.
+it introduces a level of indirection.
+Bash uses the value formed by expanding the rest of
+@var{parameter} as the new @var{parameter}; this is then
+expanded and that value is used in the rest of the expansion, rather
+than the expansion of the original @var{parameter}.
 This is known as @code{indirect expansion}.
 The value is subject to tilde expansion,
 parameter expansion, command substitution, and arithmetic expansion.

eval.c

@@ -69,6 +69,9 @@ reader_loop ()
 
   our_indirection_level = ++indirection_level;
 
+  if (just_one_command)
+    reset_readahead_token ();
+
   while (EOF_Reached == 0)
     {
       int code;

execute_cmd.c

@@ -1561,13 +1561,13 @@ execute_in_subshell (command, asynchronous, pipe_in, pipe_out, fds_to_close)
       setup_async_signals ();
       asynchronous = 0;
     }
+  else
+    set_sigint_handler ();
 
 #if defined (JOB_CONTROL)
   set_sigchld_handler ();
 #endif /* JOB_CONTROL */
 
-  set_sigint_handler ();
-
   /* Delete all traces that there were any jobs running.  This is
      only for subshells. */
   without_job_control ();

externs.h

@@ -109,6 +109,7 @@ extern int return_EOF __P((void));
 extern void push_token __P((int));
 extern char *xparse_dolparen __P((char *, char *, int *, int));
 extern void reset_parser __P((void));
+extern void reset_readahead_token __P((void));
 extern WORD_LIST *parse_string_to_word_list __P((char *, int, const char *));
 
 extern int parser_in_command_position __P((void));

lib/sh/getenv.c

@@ -69,7 +69,7 @@ getenv (name)
       if (var && exported_p (var))
 	return (value_cell (var));
     }
-  else
+  else if (environ)
     {
       register int i, len;
 

parse.y

@@ -3168,6 +3168,13 @@ reset_parser ()
   token_to_read = '\n';
 }
 
+void
+reset_readahead_token ()
+{
+  if (token_to_read == '\n')
+    token_to_read = 0;
+}
+
 /* Read the next token.  Command can be READ (normal operation) or
    RESET (to normalize state). */
 static int

shell.c

@@ -363,7 +363,7 @@ main (argc, argv, env)
 #endif /* !NO_MAIN_ENV_ARG */
 {
   register int i;
-  int code, old_errexit_flag;
+  int code, old_errexit_flag, old_onecmd;
 #if defined (RESTRICTED_SHELL)
   int saverst;
 #endif

sig.c

@@ -268,7 +268,6 @@ initialize_terminating_signals ()
 	sigaction (XSIG (i), &oact, (struct sigaction *)NULL);
 #endif /* SIGPROF && !_MINIX */
     }
-
 #else /* !HAVE_POSIX_SIGNALS */
 
   for (i = 0; i < TERMSIGS_LENGTH; i++)

support/man2html.c

@@ -1992,7 +1992,7 @@ unescape (char *c)
 	while (i < l && c[i]) {
 		if (c[i] == '\a') {
 			if (c[i+1])
-				strcpy(c + i, c + i + 1);	/* should be memmove */
+				memmove (c + i, c + i + 1, l - i);
 			else {
 				c[i] = '\0';
 				break;

tests/RUN-ONE-TEST

@@ -1,4 +1,4 @@
-BUILD_DIR=/usr/local/build/bash/bash-current
+BUILD_DIR=/usr/local/build/chet/bash/bash-current
 THIS_SH=$BUILD_DIR/bash
 PATH=$PATH:$BUILD_DIR
 

variables.c

@@ -2939,7 +2939,12 @@ bind_variable_internal (name, value, table, hflags, aflags)
     }
   else if (entry && nameref_p (entry))
     {
-      newval = nameref_cell (entry);
+      newval = nameref_cell (entry);	/* XXX - newval can't be NULL here */
+      if (valid_nameref_value (newval, 0) == 0)
+	{
+	  sh_invalidid (newval);
+	  return ((SHELL_VAR *)NULL);
+	}
 #if defined (ARRAY_VARS)
       /* declare -n foo=x[2] ; foo=bar */
       if (valid_array_reference (newval, 0))