--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/components/bash/patches/parser-oob-4.1.patch Fri Sep 26 07:30:49 2014 -0700
@@ -0,0 +1,87 @@
+# Patch Origin: http://www.openwall.com/lists/oss-security/2014/09/26/2
+# Patch is from Red Hat Security.
+# Assigned CVE-2014-7186 and CVE-2014-7187
+# CVSS Score: 4.6
+--- ../bash-4.1.orig/parse.y 2014-09-25 08:10:49.809021000 -0700
++++ parse.y 2014-09-25 11:33:15.596573700 -0700
+@@ -261,9 +261,21 @@
+
+ /* Variables to manage the task of reading here documents, because we need to
+ defer the reading until after a complete command has been collected. */
+-static REDIRECT *redir_stack[10];
++static REDIRECT **redir_stack;
+ int need_here_doc;
+
++/* Pushes REDIR onto redir_stack, resizing it as needed. */
++static void
++push_redir_stack (REDIRECT *redir)
++{
++ /* Guard against oveflow. */
++ if (need_here_doc + 1 > INT_MAX / sizeof (*redir_stack))
++ abort ();
++ redir_stack = xrealloc (redir_stack,
++ (need_here_doc + 1) * sizeof (*redir_stack));
++ redir_stack[need_here_doc++] = redir;
++}
++
+ /* Where shell input comes from. History expansion is performed on each
+ line when the shell is interactive. */
+ static char *shell_input_line = (char *)NULL;
+@@ -516,42 +528,42 @@
+ source.dest = 0;
+ redir.filename = $2;
+ $$ = make_redirection (source, r_reading_until, redir, 0);
+- redir_stack[need_here_doc++] = $$;
++ push_redir_stack ($$);
+ }
+ | NUMBER LESS_LESS WORD
+ {
+ source.dest = $1;
+ redir.filename = $3;
+ $$ = make_redirection (source, r_reading_until, redir, 0);
+- redir_stack[need_here_doc++] = $$;
++ push_redir_stack ($$);
+ }
+ | REDIR_WORD LESS_LESS WORD
+ {
+ source.filename = $1;
+ redir.filename = $3;
+ $$ = make_redirection (source, r_reading_until, redir, REDIR_VARASSIGN);
+- redir_stack[need_here_doc++] = $$;
++ push_redir_stack ($$);
+ }
+ | LESS_LESS_MINUS WORD
+ {
+ source.dest = 0;
+ redir.filename = $2;
+ $$ = make_redirection (source, r_deblank_reading_until, redir, 0);
+- redir_stack[need_here_doc++] = $$;
++ push_redir_stack ($$);
+ }
+ | NUMBER LESS_LESS_MINUS WORD
+ {
+ source.dest = $1;
+ redir.filename = $3;
+ $$ = make_redirection (source, r_deblank_reading_until, redir, 0);
+- redir_stack[need_here_doc++] = $$;
++ push_redir_stack ($$);
+ }
+ | REDIR_WORD LESS_LESS_MINUS WORD
+ {
+ source.filename = $1;
+ redir.filename = $3;
+ $$ = make_redirection (source, r_deblank_reading_until, redir, REDIR_VARASSIGN);
+- redir_stack[need_here_doc++] = $$;
++ push_redir_stack ($$);
+ }
+ | LESS_LESS_LESS WORD
+ {
+@@ -4677,7 +4689,7 @@
+ case CASE:
+ case SELECT:
+ case FOR:
+- if (word_top < MAX_CASE_NEST)
++ if ((word_top + 1) < MAX_CASE_NEST)
+ word_top++;
+ word_lineno[word_top] = line_number;
+ break;