1 			     BASH PATCH REPORT

     2 			     =================

     3 

     4 Bash-Release:	4.2

     5 Patch-ID:	bash42-012

     6 

     7 Bug-Reported-by:	Rui Santos <[email protected]>

     8 Bug-Reference-ID:	<[email protected]>

     9 Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2011-06/msg00079.html

    10 

    11 Bug-Description:

    12 

    13 When calling the parser to recursively parse a command substitution within

    14 an arithmetic expansion, the shell overwrote the saved shell input line and

    15 associated state, resulting in a garbled command.

    16 

    17 Patch (apply with `patch -p0'):

    18 

    19 *** ../bash-4.2-patched/parse.y	2011-02-26 19:19:05.000000000 -0500

    20 --- parse.y	2011-06-24 20:08:22.000000000 -0400

    21 ***************

    22 *** 3843,3846 ****

    23 --- 3849,3853 ----

    24   {

    25     sh_parser_state_t ps;

    26 +   sh_input_line_state_t ls;

    27     int orig_ind, nc, sflags;

    28     char *ret, *s, *ep, *ostring;

    29 ***************

    30 *** 3850,3857 ****

    31 --- 3857,3866 ----

    32     ostring = string;

    33   

    34 + /*itrace("xparse_dolparen: size = %d shell_input_line = `%s'", shell_input_line_size, shell_input_line);*/

    35     sflags = SEVAL_NONINT|SEVAL_NOHIST|SEVAL_NOFREE;

    36     if (flags & SX_NOLONGJMP)

    37       sflags |= SEVAL_NOLONGJMP;

    38     save_parser_state (&ps);

    39 +   save_input_line_state (&ls);

    40   

    41     /*(*/

    42 ***************

    43 *** 3862,3865 ****

    44 --- 3871,3876 ----

    45     restore_parser_state (&ps);

    46     reset_parser ();

    47 +   /* reset_parser clears shell_input_line and associated variables */

    48 +   restore_input_line_state (&ls);

    49     if (interactive)

    50       token_to_read = 0;

    51 ***************

    52 *** 5909,5912 ****

    53 --- 5920,5929 ----

    54     ps->echo_input_at_read = echo_input_at_read;

    55   

    56 +   ps->token = token;

    57 +   ps->token_buffer_size = token_buffer_size;

    58 +   /* Force reallocation on next call to read_token_word */

    59 +   token = 0;

    60 +   token_buffer_size = 0;

    61 + 

    62     return (ps);

    63   }

    64 ***************

    65 *** 5950,5953 ****

    66 --- 5967,6006 ----

    67     expand_aliases = ps->expand_aliases;

    68     echo_input_at_read = ps->echo_input_at_read;

    69 + 

    70 +   FREE (token);

    71 +   token = ps->token;

    72 +   token_buffer_size = ps->token_buffer_size;

    73 + }

    74 + 

    75 + sh_input_line_state_t *

    76 + save_input_line_state (ls)

    77 +      sh_input_line_state_t *ls;

    78 + {

    79 +   if (ls == 0)

    80 +     ls = (sh_input_line_state_t *)xmalloc (sizeof (sh_input_line_state_t));

    81 +   if (ls == 0)

    82 +     return ((sh_input_line_state_t *)NULL);

    83 + 

    84 +   ls->input_line = shell_input_line;

    85 +   ls->input_line_size = shell_input_line_size;

    86 +   ls->input_line_len = shell_input_line_len;

    87 +   ls->input_line_index = shell_input_line_index;

    88 + 

    89 +   /* force reallocation */

    90 +   shell_input_line = 0;

    91 +   shell_input_line_size = shell_input_line_len = shell_input_line_index = 0;

    92 + }

    93 + 

    94 + void

    95 + restore_input_line_state (ls)

    96 +      sh_input_line_state_t *ls;

    97 + {

    98 +   FREE (shell_input_line);

    99 +   shell_input_line = ls->input_line;

   100 +   shell_input_line_size = ls->input_line_size;

   101 +   shell_input_line_len = ls->input_line_len;

   102 +   shell_input_line_index = ls->input_line_index;

   103 + 

   104 +   set_line_mbstate ();

   105   }

   106   

   107 *** ../bash-4.2-patched/shell.h	2011-01-06 22:16:55.000000000 -0500

   108 --- shell.h	2011-06-24 19:12:25.000000000 -0400

   109 ***************

   110 *** 137,140 ****

   111 --- 139,145 ----

   112     int *token_state;

   113   

   114 +   char *token;

   115 +   int token_buffer_size;

   116 + 

   117     /* input line state -- line number saved elsewhere */

   118     int input_line_terminator;

   119 ***************

   120 *** 167,171 ****

   121 --- 172,186 ----

   122   } sh_parser_state_t;

   123   

   124 + typedef struct _sh_input_line_state_t {

   125 +   char *input_line;

   126 +   int input_line_index;

   127 +   int input_line_size;

   128 +   int input_line_len;

   129 + } sh_input_line_state_t;

   130 + 

   131   /* Let's try declaring these here. */

   132   extern sh_parser_state_t *save_parser_state __P((sh_parser_state_t *));

   133   extern void restore_parser_state __P((sh_parser_state_t *));

   134 + 

   135 + extern sh_input_line_state_t *save_input_line_state __P((sh_input_line_state_t *));

   136 + extern void restore_input_line_state __P((sh_input_line_state_t *));

   137 *** ../bash-4.2-patched/patchlevel.h	Sat Jun 12 20:14:48 2010

   138 --- patchlevel.h	Thu Feb 24 21:41:34 2011

   139 ***************

   140 *** 26,30 ****

   141      looks for to find the patch level (for the sccs version string). */

   142   

   143 ! #define PATCHLEVEL 11

   144   

   145   #endif /* _PATCHLEVEL_H_ */

   146 --- 26,30 ----

   147      looks for to find the patch level (for the sccs version string). */

   148   

   149 ! #define PATCHLEVEL 12

   150   

   151   #endif /* _PATCHLEVEL_H_ */