fix minor errors uncovered by address sanitizer; work around android issue with read -e -u; fix minor memory leaks; make spell-correct-shellword work with negative arguments; fix readline change-case on invalid multibyte character

lib/readline/kill.c

@@ -737,12 +737,9 @@ _rl_bracketed_text (size_t *lenp)
     }
   RL_UNSETSTATE (RL_STATE_MOREINPUT);
 
-  if (c >= 0)
-    {
-      if (len == cap)
-	buf = xrealloc (buf, cap + 1);
-      buf[len] = '\0';
-    }
+  if (len == cap)
+    buf = xrealloc (buf, cap + 1);
+  buf[len] = '\0';
 
   if (lenp)
     *lenp = len;

lib/readline/text.c

@@ -1449,6 +1449,7 @@ rl_change_case (int count, int op)
   int start, next, end;
   int inword, nc, nop;
   WCHAR_T c;
+  unsigned char uc;
 #if defined (HANDLE_MULTIBYTE)
   WCHAR_T wc, nwc;
   char mb[MB_LEN_MAX+1];
@@ -1503,7 +1504,9 @@ rl_change_case (int count, int op)
 	 characters */
       if (MB_CUR_MAX == 1 || rl_byte_oriented)
 	{
-	  nc = (nop == UpCase) ? _rl_to_upper (c) : _rl_to_lower (c);
+change_singlebyte:
+	  uc = c;
+	  nc = (nop == UpCase) ? _rl_to_upper (uc) : _rl_to_lower (uc);
 	  rl_line_buffer[start] = nc;
 	}
 #if defined (HANDLE_MULTIBYTE)
@@ -1511,9 +1514,16 @@ rl_change_case (int count, int op)
 	{
 	  m = MBRTOWC (&wc, rl_line_buffer + start, end - start, &mps);
 	  if (MB_INVALIDCH (m))
-	    wc = (WCHAR_T)rl_line_buffer[start];
+	    {
+	      c = rl_line_buffer[start];
+	      next = start + 1;		/* potentially redundant */
+	      goto change_singlebyte;
+	    }
 	  else if (MB_NULLWCH (m))
-	    wc = L'\0';
+	    {
+	      start = next;	/* don't bother with null wide characters */
+	      continue;
+	    }
 	  nwc = (nop == UpCase) ? _rl_to_wupper (wc) : _rl_to_wlower (wc);
 	  if  (nwc != wc)	/*  just skip unchanged characters */
 	    {
@@ -2355,8 +2365,13 @@ rl_execute_named_command (int count, int key)
 
   command = _rl_read_command_name ();
   if (command == 0 || *command == '\0')
-    return 1;
-  if (func = rl_named_function (command))
+    {
+      free (command);
+      return 1;
+    }
+  func = rl_named_function (command);
+  free (command);
+  if (func)
     {
       int prev, ostate;
 
@@ -2375,6 +2390,5 @@ rl_execute_named_command (int count, int key)
       r = 1;
     }
 
-  free (command);
   return r;
 }

lib/sh/spell.c

@@ -135,7 +135,7 @@ mindist(const char *dir, char *guess, char *best)
   (void)closedir(fd);
 
   /* Don't return `.' */
-  if (best[0] == '.' && best[1] == '\0')
+  if (dist != 3 && best[0] == '.' && best[1] == '\0')
     dist = 3;
   return dist;
 }