package/bash/bash44-006.patch

   1 From https://ftp.gnu.org/gnu/bash/bash-4.4-patches/bash44-006
   2
   3 Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
   4
   5                              BASH PATCH REPORT
   6                              =================
   7
   8 Bash-Release:   4.4
   9 Patch-ID:       bash44-006
  10
  11 Bug-Reported-by:        <fernando@null-life.com>
  12 Bug-Reference-ID:       <CAEr-gPFPvqheiAeENmMkEwWRd4U=1iqCsYmR3sLdULOqL++_tQ@mail.gmail.com>
  13 Bug-Reference-URL:
  14
  15 Bug-Description:
  16
  17 Out-of-range negative offsets to popd can cause the shell to crash attempting
  18 to free an invalid memory block.
  19
  20 Patch (apply with `patch -p0'):
  21
  22 *** bash-4.4-patched/builtins/pushd.def 2016-01-25 13:31:49.000000000 -0500
  23 --- b/builtins/pushd.def        2016-10-28 10:46:49.000000000 -0400
  24 ***************
  25 *** 366,370 ****
  26       }
  27
  28 !   if (which > directory_list_offset || (directory_list_offset == 0 && which == 0))
  29       {
  30         pushd_error (directory_list_offset, which_word ? which_word : "");
  31 --- b/366,370 ----
  32       }
  33
  34 !   if (which > directory_list_offset || (which < -directory_list_offset) || (directory_list_offset == 0 && which == 0))
  35       {
  36         pushd_error (directory_list_offset, which_word ? which_word : "");
  37 ***************
  38 *** 388,391 ****
  39 --- b/388,396 ----
  40          of the list into place. */
  41         i = (direction == '+') ? directory_list_offset - which : which;
  42 +       if (i < 0 || i > directory_list_offset)
  43 +       {
  44 +         pushd_error (directory_list_offset, which_word ? which_word : "");
  45 +         return (EXECUTION_FAILURE);
  46 +       }
  47         free (pushd_directory_list[i]);
  48         directory_list_offset--;
  49 *** bash-4.4/patchlevel.h       2016-06-22 14:51:03.000000000 -0400
  50 --- b/patchlevel.h      2016-10-01 11:01:28.000000000 -0400
  51 ***************
  52 *** 26,30 ****
  53      looks for to find the patch level (for the sccs version string). */
  54
  55 ! #define PATCHLEVEL 5
  56
  57   #endif /* _PATCHLEVEL_H_ */
  58 --- b/26,30 ----
  59      looks for to find the patch level (for the sccs version string). */
  60
  61 ! #define PATCHLEVEL 6
  62
  63   #endif /* _PATCHLEVEL_H_ */