commit bash-20170714 snapshot

CWRU/CWRU.chlog

@@ -14276,3 +14276,18 @@ lib/readline/signals.c
 	- _rl_handle_signal: make sure all uses of any of the job control
 	  signals are protected by a check for SIGTSTP being defined.  Report
 	  from Juan Manuel Guerrero <juan.guerrero@gmx.de>
+
+				   7/11
+				   ----
+lib/readline/vi_mode.c
+	- rl_vi_replace: when making the new keymap for vi replacement mode,
+	  make sure that ANYOTHERKEY is set correctly, otherwise some input
+	  will cause _rl_dispatch to return -2 to the top level.  Fixes fuzzing
+	  bug reported by Ben Wong <benjamin.a.wong@gmail.com>
+
+				   7/19
+				   ----
+builtins/read.def
+	- struct ttsave: make the attrs member a struct, not a pointer, to force
+	  a structure copy that will survive a longjmp to another context.
+	  Leaving it as a pointer to a local struct is not portable

builtins/read.def

@@ -115,7 +115,7 @@ extern int errno;
 struct ttsave
 {
   int fd;
-  TTYSTRUCT *attrs;
+  TTYSTRUCT attrs;
 };
 
 #if defined (READLINE)
@@ -494,7 +494,7 @@ read_builtin (list)
 	  /* ttsave() */
 	  termsave.fd = fd;
 	  ttgetattr (fd, &ttattrs);
-	  termsave.attrs = &ttattrs;
+	  termsave.attrs = ttattrs;
 
 	  ttset = ttattrs;	  
 	  i = silent ? ttfd_cbreak (fd, &ttset) : ttfd_onechar (fd, &ttset);
@@ -511,7 +511,7 @@ read_builtin (list)
       /* ttsave (); */
       termsave.fd = fd;
       ttgetattr (fd, &ttattrs);
-      termsave.attrs = &ttattrs;
+      termsave.attrs = ttattrs;
 
       ttset = ttattrs;
       i = ttfd_noecho (fd, &ttset);			/* ttnoecho (); */
@@ -1027,7 +1027,7 @@ static void
 ttyrestore (ttp)
      struct ttsave *ttp;
 {
-  ttsetattr (ttp->fd, ttp->attrs);
+  ttsetattr (ttp->fd, &(ttp->attrs));
   tty_modified = 0;
 }
 

lib/readline/readline.c

@@ -530,7 +530,7 @@ readline_internal_charloop (void)
 #endif
 {
   static int lastc, eof_found;
-  int c, code, lk;
+  int c, code, lk, r;
 
   lastc = EOF;
 
@@ -626,7 +626,7 @@ readline_internal_charloop (void)
 	}
 
       lastc = c;
-      _rl_dispatch ((unsigned char)c, _rl_keymap);
+      r = _rl_dispatch ((unsigned char)c, _rl_keymap);
       RL_CHECK_SIGNALS ();
 
       /* If there was no change in _rl_last_command_was_kill, then no kill

lib/readline/vi_mode.c

@@ -2074,6 +2074,9 @@ rl_vi_replace (int count, int key)
 	  vi_insertion_keymap[CTRL ('H')].function == rl_rubout)
 	vi_replace_map[CTRL ('H')].function = rl_vi_overstrike_delete;
 
+      /* Make sure this is the value we need. */
+      vi_replace_map[ANYOTHERKEY].type = ISFUNC;
+      vi_replace_map[ANYOTHERKEY].function = (rl_command_func_t *)NULL;
     }
 
   rl_vi_start_inserting (key, 1, rl_arg_sign);