Path: csiph.com!optima2.xanadu-bbs.net!xanadu-bbs.net!news.glorb.com!usenet.stanford.edu!not-for-mail From: Chet Ramey Newsgroups: gnu.bash.bug Subject: Bash-4.3 Official Patch 41 Date: Tue, 18 Aug 2015 09:16:49 -0400 Lines: 78 Sender: Chet Ramey Approved: bug-bash@gnu.org Message-ID: Reply-To: chet.ramey@case.edu NNTP-Posting-Host: lists.gnu.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: usenet.stanford.edu 1439903845 9892 208.118.235.17 (18 Aug 2015 13:17:25 GMT) X-Complaints-To: action@cs.stanford.edu Cc: chet.ramey@case.edu To: bug-bash@gnu.org Envelope-to: bug-bash@gnu.org Read-Receipt-To: chet.ramey@case.edu X-Junkmail-Status: score=10/50, host=mpv5.cwru.edu X-Junkmail-Whitelist: YES (by domain whitelist at mpv1.tis.cwru.edu) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.4.x-2.6.x [generic] X-Received-From: 129.22.105.36 X-BeenThere: bug-bash@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Bug reports for the GNU Bourne Again SHell List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Xref: csiph.com gnu.bash.bug:11365 BASH PATCH REPORT ================= Bash-Release: 4.3 Patch-ID: bash43-041 Bug-Reported-by: Hanno Böck Bug-Reference-ID: <20150623131106.6f111da9@pc1>, <20150707004640.0e61d2f9@pc1> Bug-Reference-URL: http://lists.gnu.org/archive/html/bug-bash/2015-06/msg00089.html, http://lists.gnu.org/archive/html/bug-bash/2015-07/msg00018.html Bug-Description: There are several out-of-bounds read errors that occur when completing command lines where assignment statements appear before the command name. The first two appear only when programmable completion is enabled; the last one only happens when listing possible completions. Patch (apply with `patch -p0'): *** ../bash-4.3.40/bashline.c 2014-12-29 14:39:43.000000000 -0500 --- bashline.c 2015-08-12 10:21:58.000000000 -0400 *************** *** 1469,1476 **** --- 1469,1489 ---- os = start; n = 0; + was_assignment = 0; s = find_cmd_start (os); e = find_cmd_end (end); do { + /* Don't read past the end of rl_line_buffer */ + if (s > rl_end) + { + s1 = s = e1; + break; + } + /* Or past point if point is within an assignment statement */ + else if (was_assignment && s > rl_point) + { + s1 = s = e1; + break; + } /* Skip over assignment statements preceding a command name. If we don't find a command name at all, we can perform command name *** ../bash-4.3.40/lib/readline/complete.c 2013-10-14 09:27:10.000000000 -0400 --- lib/readline/complete.c 2015-07-31 09:34:39.000000000 -0400 *************** *** 690,693 **** --- 690,695 ---- if (temp == 0 || *temp == '\0') return (pathname); + else if (temp[1] == 0 && temp == pathname) + return (pathname); /* If the basename is NULL, we might have a pathname like '/usr/src/'. Look for a previous slash and, if one is found, return the portion *** ../bash-4.3/patchlevel.h 2012-12-29 10:47:57.000000000 -0500 --- patchlevel.h 2014-03-20 20:01:28.000000000 -0400 *************** *** 26,30 **** looks for to find the patch level (for the sccs version string). */ ! #define PATCHLEVEL 40 #endif /* _PATCHLEVEL_H_ */ --- 26,30 ---- looks for to find the patch level (for the sccs version string). */ ! #define PATCHLEVEL 41 #endif /* _PATCHLEVEL_H_ */ -- ``The lyf so short, the craft so long to lerne.'' - Chaucer ``Ars longa, vita brevis'' - Hippocrates Chet Ramey, ITS, CWRU chet@case.edu http://cnswww.cns.cwru.edu/~chet/