Hi, based on the core dump from [1], need_here_doc seems to
attain the value of -1 under some conditions, thus passing
"if (need_here_doc)" clauses, in this case resulting in a segfault.

A very simple patch is attached.
Thanks,
 Ondrej

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1087010
From 25c9e25078d2b7b8667d76e53173811e8f497ed0 Mon Sep 17 00:00:00 2001
From: Ondrej Oprala <ooprala@redhat.com>
Date: Mon, 4 Aug 2014 10:21:26 +0200
Subject: [PATCH] check for need_here_doc >0

---
 eval.c  |  2 +-
 parse.y | 10 +++++-----
 y.tab.c | 10 +++++-----
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/eval.c b/eval.c
index 1f65aac..00fa056 100644
--- a/eval.c
+++ b/eval.c
@@ -237,7 +237,7 @@ parse_command ()
   current_command_line_count = 0;
   r = yyparse ();
 
-  if (need_here_doc)
+  if (need_here_doc > 0)
     gather_here_documents ();
 
   return (r);
diff --git a/parse.y b/parse.y
index cd3cf1e..bb8440d 100644
--- a/parse.y
+++ b/parse.y
@@ -1062,7 +1062,7 @@ pattern:	WORD
 list:		newline_list list0
 			{
 			  $$ = $2;
-			  if (need_here_doc)
+			  if (need_here_doc > 0)
 			    gather_here_documents ();
 			 }
 	;
@@ -1130,7 +1130,7 @@ newline_list:
 simple_list:	simple_list1
 			{
 			  $$ = $1;
-			  if (need_here_doc)
+			  if (need_here_doc > 0)
 			    gather_here_documents ();
 			  if ((parser_state & PST_CMDSUBST) && current_token == shell_eof_token)
 			    {
@@ -1146,7 +1146,7 @@ simple_list:	simple_list1
 			    $$ = connect_async_list ($1, (COMMAND *)NULL, '&');
 			  else
 			    $$ = command_connect ($1, (COMMAND *)NULL, '&');
-			  if (need_here_doc)
+			  if (need_here_doc > 0)
 			    gather_here_documents ();
 			  if ((parser_state & PST_CMDSUBST) && current_token == shell_eof_token)
 			    {
@@ -1159,7 +1159,7 @@ simple_list:	simple_list1
 	|	simple_list1 ';'
 			{
 			  $$ = $1;
-			  if (need_here_doc)
+			  if (need_here_doc > 0)
 			    gather_here_documents ();
 			  if ((parser_state & PST_CMDSUBST) && current_token == shell_eof_token)
 			    {
@@ -3031,7 +3031,7 @@ read_token (command)
     {
       /* If we're about to return an unquoted newline, we can go and collect
 	 the text of any pending here document. */
-      if (need_here_doc)
+      if (need_here_doc > 0)
 	gather_here_documents ();
 
 #if defined (ALIAS)
diff --git a/y.tab.c b/y.tab.c
index 8f7f96e..be43448 100644
--- a/y.tab.c
+++ b/y.tab.c
@@ -3103,7 +3103,7 @@ yyreduce:
 #line 1063 "/usr/homes/chet/src/bash/src/parse.y"
     {
 			  (yyval.command) = (yyvsp[(2) - (2)].command);
-			  if (need_here_doc)
+			  if (need_here_doc > 0)
 			    gather_here_documents ();
 			 }
     break;
@@ -3179,7 +3179,7 @@ yyreduce:
 #line 1131 "/usr/homes/chet/src/bash/src/parse.y"
     {
 			  (yyval.command) = (yyvsp[(1) - (1)].command);
-			  if (need_here_doc)
+			  if (need_here_doc > 0)
 			    gather_here_documents ();
 			  if ((parser_state & PST_CMDSUBST) && current_token == shell_eof_token)
 			    {
@@ -3198,7 +3198,7 @@ yyreduce:
 			    (yyval.command) = connect_async_list ((yyvsp[(1) - (2)].command), (COMMAND *)NULL, '&');
 			  else
 			    (yyval.command) = command_connect ((yyvsp[(1) - (2)].command), (COMMAND *)NULL, '&');
-			  if (need_here_doc)
+			  if (need_here_doc > 0)
 			    gather_here_documents ();
 			  if ((parser_state & PST_CMDSUBST) && current_token == shell_eof_token)
 			    {
@@ -3214,7 +3214,7 @@ yyreduce:
 #line 1160 "/usr/homes/chet/src/bash/src/parse.y"
     {
 			  (yyval.command) = (yyvsp[(1) - (2)].command);
-			  if (need_here_doc)
+			  if (need_here_doc > 0)
 			    gather_here_documents ();
 			  if ((parser_state & PST_CMDSUBST) && current_token == shell_eof_token)
 			    {
@@ -5343,7 +5343,7 @@ read_token (command)
     {
       /* If we're about to return an unquoted newline, we can go and collect
 	 the text of any pending here document. */
-      if (need_here_doc)
+      if (need_here_doc > 0)
 	gather_here_documents ();
 
 #if defined (ALIAS)
-- 
1.8.5.1

Reply via email to