Re: Heap-buffer-overflow in read_token_word() when read element with -1 index

2025-04-23 Thread Grisha Levit
On Wed, Apr 23, 2025, 11:40 Chet Ramey wrote: > > On 4/23/25 11:30 AM, Александр Ушаков wrote: > > > I encountered an issue in Bash and would like to report it. buggyfile.txt > > is attached to the email. > > > > Steps to reproduce > > > > $ CC=clang-19 CFLAGS="-fsanitize=address -g -O0" ./config

Re: Another undo list UAF

2025-01-17 Thread Grisha Levit
On Fri, Jan 17, 2025 at 5:34 PM Chet Ramey wrote: > > On 1/17/25 4:57 PM, Grisha Levit wrote: > > On Fri, Jan 17, 2025 at 4:47 PM Grisha Levit wrote: > >> > >> On Fri, Jan 17, 2025 at 9:31 AM Chet Ramey wrote: > >>> > >>> On 1/15/25 4:0

Re: Another undo list UAF

2025-01-17 Thread Grisha Levit
On Fri, Jan 17, 2025 at 4:47 PM Grisha Levit wrote: > > On Fri, Jan 17, 2025 at 9:31 AM Chet Ramey wrote: > > > > On 1/15/25 4:08 PM, Grisha Levit wrote: > > > Another undo list UAF. Related, I think, to edit-and-execute-command. > > > > > > HISTFIL

Re: Another undo list UAF

2025-01-17 Thread Grisha Levit
On Fri, Jan 17, 2025 at 9:31 AM Chet Ramey wrote: > > On 1/15/25 4:08 PM, Grisha Levit wrote: > > Another undo list UAF. Related, I think, to edit-and-execute-command. > > > > HISTFILE= INPUTRC=/ bash --norc -in <<< $' \n\cP \cN\cP\cU\cX\cE\n\e<'

Another undo list UAF

2025-01-15 Thread Grisha Levit
Another undo list UAF. Related, I think, to edit-and-execute-command. HISTFILE= INPUTRC=/ bash --norc -in <<< $' \n\cP \cN\cP\cU\cX\cE\n\e<' AddressSanitizer: heap-use-after-free on address 0xe09245621f48 READ of size 4 at 0xe09245621f48 thread T0 #0 0xb168908a6edc in rl_do_undo lib/readline/

[PATCH] _rl_abort_internal: reset _rl_command_to_execute

2024-12-13 Thread Grisha Levit
If a key sequence ending with an isearch terminator is bound to a function that longjmps, entering such a sequence during an isearch causes readline to loop forever. echo '".\e": end-kbd-macro' > irc INPUTRC=irc bash --norc -in <<< $'X\n\cRX.\e' --- lib/readline/util.c | 1 + 1 file chang

Re: history-search-* and undo lists

2024-12-13 Thread Grisha Levit
On Thu, Dec 12, 2024 at 5:03 PM Chet Ramey wrote: > > On 12/12/24 2:07 PM, Grisha Levit wrote: > > > FWIW there's still a use-after-free with something like: > > > > HISTFILE= INPUTRC=/ bash --norc -in <<< $'X\n\cPX\cR\n!\e3X\e^\n\cP' > >

Re: history-search-* and undo lists

2024-12-12 Thread Grisha Levit
On Mon, Dec 2, 2024 at 1:56 PM Chet Ramey wrote: > > On 11/18/24 10:22 PM, Grisha Levit wrote: > > But here's a remaining one in combination with history-expand-line: > > Thanks for the report. I'm not sure what to do about this one yet. > > > > > HISTFI

Re: [PATCH] lib/readline/doc makefiles clean targets

2024-11-18 Thread Grisha Levit
On Wed, Nov 13, 2024 at 11:13 AM Chet Ramey wrote: > > On 11/12/24 7:18 PM, Grisha Levit wrote: > > > The latest change, > > > > +Makefile.in > > + - y.tab.h: move from CREATED_HEADERS to INSTALLED_HEADERS so we don't > > + clean it > > > >

Re: history-search-* and undo lists

2024-11-18 Thread Grisha Levit
On Tue, Nov 5, 2024 at 11:20 AM Chet Ramey wrote: > > On 10/18/24 4:22 PM, Grisha Levit wrote: > > There's some issue with undo list handling in history-search-* commands: > > > > Doing a successful search with a line that has an undo list causes the > > un

Re: [PATCH] Makefile.in: add LIBINTL_H to install-headers

2024-11-13 Thread Grisha Levit
On Wed, Nov 13, 2024 at 3:45 PM Chet Ramey wrote: > > On 11/12/24 8:17 PM, Grisha Levit wrote: > > I'm not sure if this is the most idiomatic way to write the rule, but > > if a libintl.h is generated, it needs to make it into the installed > > headers directory to al

[PATCH] bash.pc.in: use DEFS

2024-11-12 Thread Grisha Levit
If you try using Cflags from the generated pc file, presumably with something like: cc $(pkg-config --cflags bash) -c o myload myload.c the compilation is likely to fail because HAVE_CONFIG_H is not defined. --- support/bash.pc.in | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff

[PATCH] Makefile.in: add LIBINTL_H to install-headers

2024-11-12 Thread Grisha Levit
I'm not sure if this is the most idiomatic way to write the rule, but if a libintl.h is generated, it needs to make it into the installed headers directory to allow loadables to build. --- Makefile.in | 4 1 file changed, 4 insertions(+) diff --git a/Makefile.in b/Makefile.in index 00db8cbb.

Re: [PATCH] lib/readline/doc makefiles clean targets

2024-11-12 Thread Grisha Levit
On Thu, Nov 7, 2024 at 6:06 PM Chet Ramey wrote: > > On 11/4/24 9:44 AM, Mike Jonkmans wrote: > > > There are some issues though. Some less important. > > 1) After 'make distclean', it doesn't build: some .o files need y.tab.h. > > y.tab.h isn't part of the devel branch, you need bison to build it

Re: "complete -o filenames" sometimes not working

2024-11-11 Thread Grisha Levit
On Sat, Nov 9, 2024, 07:41 Clark Wang wrote: > On Sat, Nov 9, 2024 at 1:48 AM Chet Ramey wrote: > > > > > OK. You asked for the completions to be treated as filenames. When > > readline displays the possible completions for filenames, it doesn't > > display the full pathname -- just the portion

[PATCH] Makefile: avoid undefined variables

2024-10-24 Thread Grisha Levit
These are reported by make --warn-undefined-variables. Most were being set previously (sometimes 20 years ago) and got left behind in recepies after their definitions have been removed. Others only get set in some configurations so it makes sense to prevent them from inheriting stray values from t

[PATCH] BASH_STRUCT_DIRENT*: simplify

2024-10-23 Thread Grisha Levit
The BASH_STRUCT_DIRENT* macros duplicate the caching, message printing, and defining functionality already present in the AC_CHECK_MEMBERS macro that gets called. It's cosmetic, but causes the configure output to look like: checking for struct dirent.d_ino... checking for struct dirent.d_ino.

[PATCH] BASH_FUNC_STRTOIMAX: fix and simplify

2024-10-23 Thread Grisha Levit
Without an existing cache, if we run ./configure -C, we get the odd- looking: checking for usable strtoimax... checking for strtoimax... yes checking whether strtoimax is declared... yes yes config.h is correct though: #define HAVE_DECL_STRTOIMAX 1 #define HAVE_STRTOIMAX 1 H

Re: ${param@a} should bypass unbound variable check or be processed ahead of it.

2024-10-20 Thread Grisha Levit
On Sun, Oct 13, 2024, 14:58 Chet Ramey wrote: > On 10/1/24 3:54 AM, konsolebox wrote: > > # declare -A x > > # echo ${x@a} > > A > > # set -u > > # echo ${x@a} > > bash: x: unbound variable > > > > Obvious workaround would be to disable `set -u` temporarily or assign > > a temporary array value b

Re: 'wait -n' with and without id arguments

2024-10-20 Thread Grisha Levit
On Sun, Oct 20, 2024, 20:52 Zachary Santer wrote: > > Item 8 is just odd and is on the verge of being a dealbreaker. Not to > go off on another tangent, but what on Earth? > AFAICT it's the non-POSIX-mode Bash behavior that is unusual. While all shells will have treat single quotes as literal h

[PATCH] isearch: fix with HANDLE_MULTIBYTE && LC_ALL=C

2024-10-18 Thread Grisha Levit
Sorry, previous patch should have been: --- lib/readline/isearch.c | 7 --- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/lib/readline/isearch.c b/lib/readline/isearch.c index 9ddf9ce3..c6d8c8a8 100644 --- a/lib/readline/isearch.c +++ b/lib/readline/isearch.c @@ -742,10 +742,11

[PATCH] isearch: fix with HANDLE_MULTIBYTE && LC_ALL=C

2024-10-18 Thread Grisha Levit
HISTFILE= INPUTRC=/ LC_ALL=C bash --norc -in <<< $'\cR.' WARNING: MemorySanitizer: use-of-uninitialized-value #0 _rl_isearch_dispatch isearch.c:745:31 #1 rl_search_historyisearch.c:926:11 #2 rl_reverse_search_historyisearch.c:135:11 #3 _rl_dispatch_subse

history-search-* and undo lists

2024-10-18 Thread Grisha Levit
There's some issue with undo list handling in history-search-* commands: Doing a successful search with a line that has an undo list causes the undo entries from that list to leaked: HISTFILE= INPUTRC=/ bash --norc -in <<< $'X\nX\e[5~' =

Re: [PATCH] histfile: fix mmap page alignment

2024-10-18 Thread Grisha Levit
On Fri, Oct 18, 2024 at 12:15 PM Chet Ramey wrote: > > On 10/18/24 11:51 AM, Chet Ramey wrote: > > On 10/17/24 8:27 PM, Grisha Levit wrote: > >> The mmap in history_do_write would usually fail when appending because > >> the offset must be a multiple of the pag

[PATCH] rl_tilde_expand: avoid uninitialized memory use

2024-10-17 Thread Grisha Levit
$ bash --norc -in <<< $'\e&' WARNING: MemorySanitizer: use-of-uninitialized-value #0 rl_tilde_expand lib/readline/util.c:208:10 --- lib/readline/util.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/readline/util.c b/lib/readline/util.c index 2bcc776a..d03

[PATCH] histfile: fix mmap page alignment

2024-10-17 Thread Grisha Levit
The mmap in history_do_write would usually fail when appending because the offset must be a multiple of the page size. --- lib/readline/histfile.c | 15 +++ 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/lib/readline/histfile.c b/lib/readline/histfile.c index a5fb11d2..

Re: Bug report in ubuntu 24.04

2024-10-06 Thread Grisha Levit
This isn't a bug in bash. You might find some of the suggestions in https://github.com/rstudio/rstudio/issues/8539 helpful. On Sun, Oct 6, 2024, 18:02 Luis Vazquez de Lara via Bug reports for the GNU Bourne Again SHell wrote: > Reporting a bug after in RStudio terminal with the aliases > > Dr. L

[PATCH] help -d: print loadable builtins correctly

2024-10-03 Thread Grisha Levit
help -d output assumes that long_doc[0] includes a newline, which is not the case for loadable builtins: $ enable ln rm $ help -d ln rm ln - Link files.rm - Remove files --- builtins/help.def | 11 --- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/builtins/help

[PATCH] BASH_SOURCE_FULLPATH_DEFAULT fixup

2024-10-03 Thread Grisha Levit
Fix typo in configure.ac causing: src/bash/configure: 3892: test: =: unexpected operator Update shopt reset code to use new define. --- builtins/shopt.def | 2 +- configure.ac | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/builtins/shopt.def b/builtins/shopt

[PATCH] braces: avoid signed overflow

2024-10-01 Thread Grisha Levit
INTMAX_MAX=9223372036854775807 eval ": {$((INTMAX_MAX-1))..$((INTMAX_MAX))}" braces.c:447:9: runtime error: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'intmax_t' (aka 'long') --- braces.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/b

Re: [PATCH] Correct error message when using -n and -o ignoreeof in interactive mode

2024-08-21 Thread Grisha Levit
On Wed, Aug 21, 2024, 11:27 Chet Ramey wrote: > On 8/19/24 9:52 AM, Ángel wrote: > > On 2024-08-18 at 11:21 +0700, Robert Elz wrote: > >> Interactive shells with -n (noexec) set are pointless > > > > The man page states: > >>-n Read commands but do not execute them. This may

[PATCH] bash_source_fullpath: add to reset_shopt_options

2024-08-19 Thread Grisha Levit
This was actually caught by the test suite --- builtins/shopt.def | 1 + tests/shopt.right | 4 2 files changed, 1 insertion(+), 4 deletions(-) diff --git a/builtins/shopt.def b/builtins/shopt.def index 67bc0c22..37fda11e 100644 --- a/builtins/shopt.def +++ b/builtins/shopt.def @@ -357,6 +3

Another redisplay issue in single-byte locales

2024-08-13 Thread Grisha Levit
In a single-byte locale, if the prompt is wider than the screen width and contains invisible characters on the last line, and the input line is also wider than the screen width, redisplay gets messed up: printf -v s '%*s' "$COLUMNS" PS1=$s'%\[\e[0m\]' LC_ALL=C bash --norc -in <<< $s$'X\caY

Re: printf inconsistent results for %.0f

2024-08-13 Thread Grisha Levit
On Mon, Aug 12, 2024, 11:04 Chet Ramey wrote: > My question is why the (admittedly old) gnulib replacement strtod/strtold > is messing things up. > Looks like printf(3) gets called with a `Lf' conversation specifier and a double argument. diff --git a/builtins/printf.def b/builtins/printf.def i

[PATCH] read: unsigned char delim issues

2024-08-13 Thread Grisha Levit
The new read_mbchar code is missing an (unsigned char) cast, causing an invalid continuation byte >0x7F to fail to be recognized as a delimiter on platforms where char is signed. $ printf '\317_' | { read -d _; echo "${REPLY@Q}"; } $'\317' $ printf '\317\360_' | { read -d $'\360'; echo

termios.h not included if sys/ioctl.h provides struct winsize

2024-08-12 Thread Grisha Levit
On e.g. Alpine Linux, the following are set by configure: bash_cv_struct_winsize_ioctl='yes' bash_cv_struct_winsize_termios='yes' bash_cv_struct_winsize_header='ioctl_h' ac_cv_func_tcgetwinsize='yes' and so config.h ends up with: #define STRUCT_WINSIZE_IN_SYS_IOCTL 1 /* #

Re: whats wrong , exit code 11 on android termux

2024-08-06 Thread Grisha Levit
On Tue, Aug 6, 2024, 14:19 alex xmb sw ratchev wrote: > ~ $ alias tm='timemark+=( $EPOCHREALTIME )' > ~ $ tm > > [Process completed (signal 11) - press Enter] > I believe this was reported in https://lists.gnu.org/archive/html/bug-bash/2023-05/msg00146.html and fixed in https://git.savannah.gnu.

[PATCH] tests: printf: provide explicit TZ start/end

2024-06-11 Thread Grisha Levit
POSIX says about the TZ variable: If the dst field is specified and the rule field is not, it is implementation-defined when the changes to and from DST occur. musl seems to interpret `TZ=EST5EDT` as having DST always in effect, causing the tests that rely on the glibc behavior (of defaul

Re: [PATCH] cond expr: cleanup on errors

2024-06-04 Thread Grisha Levit
On Mon, Jun 3, 2024 at 3:53 PM Chet Ramey wrote: > > On 5/31/24 5:07 PM, Grisha Levit wrote: > > Two minor leak fixes for conditional command error conditions: > > > > If a WORD token is read when COND_AND, COND_OR, COND_END, or a binary > > operator are expect

Re: [PATCH] cond expr: cleanup on errors

2024-06-03 Thread Grisha Levit
On Mon, Jun 3, 2024 at 3:53 PM Chet Ramey wrote: > > On 5/31/24 5:07 PM, Grisha Levit wrote: > > Two minor leak fixes for conditional command error conditions: > > > > If a WORD token is read when COND_AND, COND_OR, COND_END, or a binary > > operator are expect

[PATCH] exec: free args on failed exec

2024-05-31 Thread Grisha Levit
The comment describing why this wasn't done has been there since the start of the repo's history and AFAICT it is not accurate anymore, as shell_execve only calls realloc when it's going to longjmp rather than return. Fixes leak in bash -O execfail -c 'exec /; :' --- builtins/exec.def | 4 --

[PATCH] expand_word_internal: fix leak with W_NOSPLIT2

2024-05-31 Thread Grisha Levit
Free temporary list allocated when exapnding `$@' in bash -c 'IFS=:; : ${_+$@}' _ X --- subst.c | 1 + 1 file changed, 1 insertion(+) diff --git a/subst.c b/subst.c index 3faa4068..c56d2434 100644 --- a/subst.c +++ b/subst.c @@ -12144,6 +12144,7 @@ finished_with_string: retu

[PATCH] coproc: do not leak name

2024-05-31 Thread Grisha Levit
When a named coproc is created, the name string and associated WORD_DESC are leaked. --- parse.y | 2 ++ 1 file changed, 2 insertions(+) diff --git a/parse.y b/parse.y index d39d6737..fe5038be 100644 --- a/parse.y +++ b/parse.y @@ -1103,6 +1103,7 @@ coproc: COPROC shell_command

[PATCH] cond expr: cleanup on errors

2024-05-31 Thread Grisha Levit
Two minor leak fixes for conditional command error conditions: If a WORD token is read when COND_AND, COND_OR, COND_END, or a binary operator are expected, the allocated WORD_DESC is leaked. If a conditional command has a syntax error, the allocated COMMAND is leaked. --- parse.y | 14 ++

[PATCH] bind_assoc_variable: free key if cannot assign

2024-05-30 Thread Grisha Levit
Avoid leaking expansion of `x' in `declare -Ar A; A[x]=' --- arrayfunc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arrayfunc.c b/arrayfunc.c index e85ba6e5..aaa1963c 100644 --- a/arrayfunc.c +++ b/arrayfunc.c @@ -302,6 +302,7 @@ bind_assoc_variable (SHELL_VAR *entry, const char *name, c

[PATCH] read: free ifs_chars

2024-05-29 Thread Grisha Levit
Avoid leaking ifs_chars on more return paths. --- builtins/read.def | 16 1 file changed, 16 insertions(+) diff --git a/builtins/read.def b/builtins/read.def index 37328efc..69a1ef4c 100644 --- a/builtins/read.def +++ b/builtins/read.def @@ -635,6 +635,8 @@ read_builtin (WORD_LIS

[PATCH] readstr: do not clear undo list

2024-05-27 Thread Grisha Levit
The undo command fails if invoked via execute-named-command on a line from the history list: $ bash --norc -in <<< $'A\n\cPB\c_C' bash-5.3$ A bash-5.3$ AC $ bash --norc -in <<< $'A\n\cPB\exundo\nC' bash-5.3$ A bash-5.3$ ABC AFAICT the rl_maybe_replace_line in _rl_readstr_

compute_lcd_of_matches w/ mismatched upper/lowercase byte counts

2024-05-24 Thread Grisha Levit
This requires case-insensitive completion of two+ words where the the prefix in a word contains the single-byte lowercase form of the multi- byte character occuring in the same position in an earlier word. The words here start consist of one of the following followed by `-': U+212A KELVIN SIG

Re: segmentation fault after interrupting function that uses "time"

2024-05-23 Thread Grisha Levit
On Thu, May 23, 2024 at 3:55 PM Chet Ramey wrote: > > On 5/23/24 7:43 AM, Michael Maurer wrote: > > > Bash Version: 5.2 > > Patch Level: 15 > > Release Status: release > > > > Description: > > Calling a function that itself uses the keyword "time" to call > > another function that performs

Re: [PATCH] rl_change_case: skip over invalid mbchars

2024-05-23 Thread Grisha Levit
On Thu, May 23, 2024 at 4:11 PM Chet Ramey wrote: > > On 5/23/24 3:25 PM, Grisha Levit wrote: > > On Thu, May 23, 2024 at 10:25 AM Chet Ramey wrote: > >> > >> On 5/21/24 2:42 PM, Grisha Levit wrote: > >>> Avoid using (size_t)-1 as an offset. > >

Re: [PATCH] rl_change_case: skip over invalid mbchars

2024-05-23 Thread Grisha Levit
On Thu, May 23, 2024 at 10:25 AM Chet Ramey wrote: > > On 5/21/24 2:42 PM, Grisha Levit wrote: > > Avoid using (size_t)-1 as an offset. > > I can't reproduce this on macOS. Where is the code that's using -1 as an > offset? The loop in rl_change_case does the follo

[PATCH] dynamic-complete-history: avoid null ptr qsort UB

2024-05-21 Thread Grisha Levit
$ HISTFILE= bash --norc -in <<< $'#\n#\e\t' bashline.c:3720:16: runtime error: null pointer passed as argument 1, which is declared to never be null /usr/include/stdlib.h:971:30: note: nonnull attribute specified here SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior bashline.c:3720:16 ---

[PATCH] spell-correct-word: avoid inf loop with neg arg

2024-05-21 Thread Grisha Levit
bash --norc -in <<< $'A \e-\cXs' --- bashline.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/bashline.c b/bashline.c index 528f56e0..0a4e280e 100644 --- a/bashline.c +++ b/bashline.c @@ -1336,6 +1336,9 @@ bash_spell_correct_shellword (int count, int key) int wbeg, wend; char *text

[PATCH] spell-correct-word: fix small leak

2024-05-21 Thread Grisha Levit
Avoid leak when spell-correcting an empty line. --- bashline.c | 5 - 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/bashline.c b/bashline.c index 525d065a..528f56e0 100644 --- a/bashline.c +++ b/bashline.c @@ -1348,7 +1348,10 @@ bash_spell_correct_shellword (int count, int key)

[PATCH] rl_change_case: skip over invalid mbchars

2024-05-21 Thread Grisha Levit
Avoid using (size_t)-1 as an offset. Also, not sure it makes sense to change the case of an invalid byte cast to (wchar_t). $ bash --norc -in <<< $'\300\e-1\eL' lib/readline/text.c:1544:26: runtime error: addition of unsigned offset to 0x51100680 overflowed to 0x5110067f ERROR: AddressSa

[PATCH] bashline: small leaks

2024-05-21 Thread Grisha Levit
- free directory_part when completing command words like `~/bin/' - free contents of matches when completing command words in old-style command substitutions --- bashline.c | 7 ++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/bashline.c b/bashline.c index b638e001..525d065a

[PATCH] execute-named-command: fix small leaks

2024-05-21 Thread Grisha Levit
- free command if it is the empty string - free command before calling bound function, in case bound function does not return, like rl_abort --- lib/readline/text.c | 7 --- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/lib/readline/text.c b/lib/readline/text.c index c5281efe

[PATCH] spell.c: uninitialized value in mindist

2024-05-20 Thread Grisha Levit
./bash --norc -in <<<$'XX\cXs' bash-5.3$ XX==34016==WARNING: MemorySanitizer: use-of-uninitialized-value #0 0xaafbbb80 in mindist /home/vm/src/bash/local/lib/sh/spell.c:138:22 #1 0xaafbb468 in spname /home/vm/src/bash/local/lib/sh/spell.c:90:11 #2 0xaafbbe78 in dirspell /hom

Re: [PATCH] bracketed paste unterminated buffer

2024-05-20 Thread Grisha Levit
On Mon, May 20, 2024, 10:52 Chet Ramey wrote: > On 5/20/24 10:42 AM, Grisha Levit wrote: > > If bracketed paste input terminates prior to the paste end sequence, > > How would this happen? The terminal emulator (or whatever) performing > the paste guarantees it. > Maybe ove

[PATCH] bracketed paste unterminated buffer

2024-05-20 Thread Grisha Levit
If bracketed paste input terminates prior to the paste end sequence, the buffer passed to rl_insert_text never gets its null termination. $ bash-asan --norc -in <<<$'\e[200~X' ==15989==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x006167e51260 at pc 0x007e690b5374 bp 0x007ff50ab620 s

Re: ${var/\#} no longer works

2024-05-19 Thread Grisha Levit
On Sun, May 19, 2024, 14:05 konsolebox wrote: > Here's an output from devel branch bash and 5.2.26: > > $ bash-9 -c 'echo "$BASH_VERSION"; x="abc#xyz"; echo "${x/\#}"' > 5.3.0(1)-alpha > abc#xyz > $ bash-5.2.26 -c 'echo "$BASH_VERSION"; x="abc#xyz"; echo "${x/\#}"' > 5.2.26(1)-release > abcxy

Re: [PATCH] globsort: handle int overflow in cmp functions

2024-05-17 Thread Grisha Levit
On Fri, May 17, 2024 at 3:06 PM Chet Ramey wrote: > > On 5/17/24 12:57 PM, Grisha Levit wrote: > > The current cmp implementation for size and blocks subtracts the two > > values and returns the difference as an int. This subtraction can > > overflow, and the returned i

[PATCH] globsort: handle int overflow in cmp functions

2024-05-17 Thread Grisha Levit
The current cmp implementation for size and blocks subtracts the two values and returns the difference as an int. This subtraction can overflow, and the returned int can end up having the wrong sign. This also makes the qsort comparison function non-transitive. (Some interesting discussion on that

[PATCH] fdopen in read -e -u N

2024-05-17 Thread Grisha Levit
Looks like `read -e -u N' creates (and leaks) a new stream for fd N. If a second `read' tries to fdopen the same fd once more, Android's FDSAN (on and enforcing defualt) causes the process to abort: $ bash -c 'read -eu3; read -eu3' 3<&0 fdsan: failed to exchange ownership of file descriptor: fd 3

[PATCH] use newly loaded compspec in more cases

2024-05-15 Thread Grisha Levit
If a completion function installs a new compspec and returns 124, and the new compspec is for something other than the exact name currently being completed (i.e. a new default compspec, or a compspec for the basename of a command being completed that includes a slash), the newly installed compspec

[PATCH] builtins build with -std=

2024-05-15 Thread Grisha Levit
When building with glibc and an -std= arg in CFLAGS, asort and cat fail to build since sigsetjmp is guarded by _POSIX_C_SOURCE In file included from bashjmp.h:24, from shell.h:25, from examples/loadables/cat.c:30: include/posixjmp.h:29:25: error: unknown type name

build failure without system extension macros

2024-05-15 Thread Grisha Levit
Since 9c430f6b changed some files to no longer include config.h, building with glibc and an -std= in CFLAGS fails because getopt, used in support/bashversion.c and mksyntax.c, is guarded by _POSIX_C_SOURCE >= 2 || _XOPEN_SOURCE support/bashversion.c:69:17: warning: implicit declaration of function

[PATCH] tests/cond-regexp3.sub: avoid ERE UB

2024-05-07 Thread Grisha Levit
This test fails on systems with recent-ish BSD regex libs, where a backslash followed by an alphabetic chatacter now throws REG_EESCAPE. See https://reviews.freebsd.org/D10510 --- tests/cond-regexp3.sub | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/cond-regexp3.sub b/t

Re: [5.3-alpha] ">& /some/file" would fail when /some/file already exists

2024-04-26 Thread Grisha Levit
On Thu, Apr 25, 2024, 23:03 Oğuz wrote: > On Fri, Apr 26, 2024 at 1:17 AM Grisha Levit > wrote: > > Actually, I see this on Ubuntu 22.04 but not on macOS. > On Linux, O_EXCL and RX_EXPANDED (a flag used by bash to signal that > the redirection word is already expanded) has

Re: [5.3-alpha] ">& /some/file" would fail when /some/file already exists

2024-04-25 Thread Grisha Levit
On Thu, Apr 25, 2024 at 6:05 PM Grisha Levit wrote: > > On Thu, Apr 25, 2024, 14:55 Chet Ramey wrote: >> >> On 4/25/24 12:18 PM, Clark Wang wrote: >> > (I'm using the "devel" branch as the "bash-5.3-testing" branch failed >> >

Re: [5.3-alpha] ">& /some/file" would fail when /some/file already exists

2024-04-25 Thread Grisha Levit
On Thu, Apr 25, 2024, 14:55 Chet Ramey wrote: > On 4/25/24 12:18 PM, Clark Wang wrote: > > (I'm using the "devel" branch as the "bash-5.3-testing" branch failed > > to build for me. HEAD: 8c8daff1e3661c) > > > > To reproduce: > > > > $ bash53 --norc > > bash53-5.3# touch /tmp/file > > bash53-5.3#

Re: 5.3-alpha: less readable output when set -x

2024-04-24 Thread Grisha Levit
On Wed, Apr 24, 2024 at 11:35 AM wrote: > > hello > > Apologies if I am missing some blatant point here > > I have noticed a difference in behavior of bash-5.2.26 and > bash-5.3-alpha which isn't a problem of correctness, but may be wasn't > intentional(?) This is from https://lists.gnu.org/archi

Re: install-headers stdckdint.h error

2024-03-29 Thread Grisha Levit
On Fri, Mar 29, 2024, 09:37 Chet Ramey wrote: > On 3/28/24 9:54 PM, Grisha Levit wrote: > > The addition of stdckdint.h to CREATED_HEADERS in Makefile.in leads to > > an error when installing loadable builtins on platforms that provide > > the header: > > Thanks for th

install-headers stdckdint.h error

2024-03-28 Thread Grisha Levit
The addition of stdckdint.h to CREATED_HEADERS in Makefile.in leads to an error when installing loadable builtins on platforms that provide the header: install: cannot stat '/tmp/bash/stdckdint.h': No such file or directory make[2]: *** [Makefile:903: install-headers] Error 1 make[2]: Leaving dire

funsub in PS2

2024-03-26 Thread Grisha Levit
Having funsubs in PS2 seems to cause input tokens that are split across lines to be partially replaced with the last token of the last funsub to be parsed while expanding the prompt string. $ PS2='${ : ; }> ' $ printf '[%s]\n' ab\ > cd [XXcd]

[PATCH] fix cmd and hist nums in ${var@P} inside $PS[012]

2024-03-26 Thread Grisha Levit
When \# or \! is decoded in a ${var@P} expansion embedded in a prompt string, the value can be off by one from that of the same sequence embedded directly in the prompt string. $ H='\!' $ PS1='(\!:${H@P}) $' (3:2 501:500) $ * parse.y - decode_prompt_string: accept new int flag to sign

Re: [PATCH] retry opening startup files on EINTR

2024-02-20 Thread Grisha Levit
On Tue, Feb 20, 2024 at 9:18 AM Chet Ramey wrote: > > Well, depending on when the terminal emulator sends the SIGWINCH, this is > probably a bug in Dropbox or the File Provider code. Bash installs its > SIGWINCH handler with SA_RESTART, and the default disposition is to > discard, so even if a SIG

Re: [PATCH] retry opening startup files on EINTR

2024-02-20 Thread Grisha Levit
On Tue, Feb 20, 2024 at 4:35 AM Grisha Levit wrote: > > Though a similar test shows that the Readline part of the patch is wrong, > and I'm not sure how to solve it, at least without changing existing > applications' behavior (and requiring signal setup to happen bef

Re: [PATCH] retry opening startup files on EINTR

2024-02-20 Thread Grisha Levit
On Mon, Feb 19, 2024 at 5:10 PM Chet Ramey wrote: > > On 2/7/24 1:33 AM, Grisha Levit wrote: > > I have some dotfiles symlinked to storage backed by a macOS File > > Provider extension (e.g. Dropbox): > > > > $ realpath ~/.bash_profile > > /User

Re: [PATCH] use unlocked stdio functions

2024-02-17 Thread Grisha Levit
On Sat, Feb 17, 2024, 12:29 Chet Ramey wrote: > On 2/16/24 9:37 PM, Grisha Levit wrote: > > After this change, `make -C examples/loadables others` fails building > > necho.o with: > > > > use of undeclared identifier 'fflush_unlocked' > > I can&#

Re: $* within a here-document puts space instead of the first IFS char.

2024-02-16 Thread Grisha Levit
On Fri, Feb 16, 2024 at 9:02 PM Damien ISSANCHOU wrote: > When expanding $* within a here-document, bash puts a space between > each positional parameters while I would expect it to put the first > character of the IFS variable (if it contains at least one character) as > per POSIX.1-2017. F

Re: Bash 5.1: Make shell_script_filename available to startup files

2024-02-16 Thread Grisha Levit
On Fri, Feb 16, 2024, 16:17 Marc Aurèle La France wrote: > > On Mon, 2021-Feb-01, Marc Aurèle La France wrote: > > > Currently, only the script's arguments are passed as positional > > parameters. For compatibility reasons, $0 cannot be used to also pass the > > script's filename, so I'm creating

Re: [PATCH] use unlocked stdio functions

2024-02-16 Thread Grisha Levit
After this change, `make -C examples/loadables others` fails building necho.o with: use of undeclared identifier 'fflush_unlocked' I checked other object files to make sure the expected symbols are used and they were, except for the loadable pushd. Also added the dependency where needed in M

Re: It is possible to remove the readonly attribute from {BASH, SHELL}OPTS

2024-02-16 Thread Grisha Levit
On Fri, Feb 16, 2024 at 11:32 AM Chet Ramey wrote: > > On 2/13/24 12:41 PM, Grisha Levit wrote: > > On Wed, Jan 31, 2024, 14:10 Chet Ramey > <mailto:chet.ra...@case.edu>> wrote: > > > > Well, is this a "my arm hurts when I do this" problem

Re: It is possible to remove the readonly attribute from {BASH, SHELL}OPTS

2024-02-13 Thread Grisha Levit
On Wed, Jan 31, 2024, 14:10 Chet Ramey wrote: > Well, is this a "my arm hurts when I do this" problem, or should bash > restrict the types of attributes that can be set on readonly variables? > For the attributes that only affect future assignments ([iluc]), I think think it makes sense to eithe

[PATCH] rltech.texi: missing @end deftypevar

2024-02-12 Thread Grisha Levit
Building readline.info fails in the devel branch: $ make readline.info rltech.texi:2399: @node seen before @end deftypevar make: *** [readline.info] Error 1 --- lib/readline/doc/rltech.texi | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/readline/doc/rltech.texi b/lib/readlin

[PATCH] expand_declaration_argument: handle mixed on/off opts

2024-02-12 Thread Grisha Levit
When assigning a variable as part of expanding a compound assignment argument, any [aAgGiIluc] options are treated as either all being on or all being off: $ unset X; declare -a +i X=(2+2); declare -p X declare -a X=([0]="4") $ unset X; declare +i -u X=(foo); declare -p X declare

Re: declare -A +A

2024-02-12 Thread Grisha Levit
On Mon, Feb 12, 2024 at 4:13 PM Chet Ramey wrote: > > On 2/7/24 2:23 AM, Grisha Levit wrote: > > If a single declare command both sets and unsets the array or assoc > > attribute for an existing scalar variable, the `value' member of the > > SHELL_VAR is assigne

Re: [PATCH] printf6.sub: set LC_ALL

2024-02-07 Thread Grisha Levit
On Wed, Feb 7, 2024, 14:45 Kerin Millar wrote: > On Wed, 7 Feb 2024 13:59:47 -0500 > Grisha Levit wrote: > > > +#LC_ALL=en_US.UTF-8 > > Is this not merely adding a comment? > Sorry you're right, made the patch after commenting my change out to confirm it was needed. >

[PATCH] printf6.sub: set LC_ALL

2024-02-07 Thread Grisha Levit
The tests in printf6.sub fail if `make check' is executed in the C locale. diff --git a/tests/printf6.sub b/tests/printf6.sub index fbacd4d5..382943c7 100644 --- a/tests/printf6.sub +++ b/tests/printf6.sub @@ -11,6 +11,8 @@ # You should have received a copy of the GNU General Public License #

declare -A +A

2024-02-06 Thread Grisha Levit
If a single declare command both sets and unsets the array or assoc attribute for an existing scalar variable, the `value' member of the SHELL_VAR is assigned an ARRAY* or HASH_TABLE* as appropriate, but later ends up treated as a char*: $ bash-asan -c 'X=Y; declare -A +A X; declare -p X'

declare -Aa var

2024-02-06 Thread Grisha Levit
If given both the -a and -A flags and an existing scalar variable, declare will assign both attributes to the variable: $ V=X; declare -Aa V; echo $? 0 $ echo ${V@a} aA $ (declare -p V) Segmentation fault: 11

[PATCH] ASS_NOEVAL for BASHOPTS and SHELLOPTS

2024-02-06 Thread Grisha Levit
(Prompted by the report from Emanuele Torre in [1]) The value of currently_executing_command is garbage when there is an error during assignment when popping the variable context: $ bash -c 'declare -i SHELLOPTS; f() { local -; set -f; }; f' |& cat -v bash: line 1: M-`^WM-R^N^\{: braceexp

[PATCH] retry opening startup files on EINTR

2024-02-06 Thread Grisha Levit
I have some dotfiles symlinked to storage backed by a macOS File Provider extension (e.g. Dropbox): $ realpath ~/.bash_profile /Users/levit/Library/CloudStorage/Dropbox/profile/.bash_profile This normally works fine, except when my terminal emulator (tested both Terminal.app and iTerm) re

[PATCH] use unlocked stdio functions

2024-02-05 Thread Grisha Levit
Bash makes many calls to stdio functions that may have unlocked_stdio(3) equivalents. Since the locking functionality provided by the regular versions is only useful in multi-threaded applications, it probably makes sense for Bash to use the *_unlocked versions where available. E.g. in situations

Re: [PATCH] printf: more error handling

2024-02-05 Thread Grisha Levit
On Sat, Feb 3, 2024 at 1:05 PM Chet Ramey wrote: > > On 2/2/24 6:33 PM, Grisha Levit wrote: > > Is it necessary to check the error indicator if printf(3) just had a non- > > negative return? > > I think printf is allowed to set the error flag that ferror checks even if >

Re: [PATCH] printf: more error handling

2024-02-02 Thread Grisha Levit
On Thu, Feb 1, 2024 at 7:41 PM Chet Ramey wrote: > > On 1/22/24 9:44 PM, Grisha Levit wrote: > > The size of the buffer used for printf -v is tracked in an int but this > > can overflow since the buffer can be built up by multiple vsnprintf(3) > > calls, each of which

heap-use-after-free in executing_line_number

2024-01-25 Thread Grisha Levit
If currently_executing_command was a subshell, it can end up freed by the time executing_line_number checks it. $ bash-asan -c '${ (:); }/' = ERROR: AddressSanitizer: heap-use-after-free on address 0x000106208a40 at pc 0x000102c8bf38

[PATCH] printf: more error handling

2024-01-22 Thread Grisha Levit
The size of the buffer used for printf -v is tracked in an int but this can overflow since the buffer can be built up by multiple vsnprintf(3) calls, each of which can append up to INT_MAX bytes to the buffer: $ INT_MAX=$(getconf INT_MAX) $ printf -v VAR "%$((INT_MAX-1))s%$((INT_MAX-1))s"

Re: ./script doesn't work in completion function

2024-01-22 Thread Grisha Levit
On Mon, Jan 22, 2024, 01:54 Martin D Kealey wrote: > You seem to have created an invalid executable. It seems that scripts > without a #! can only be run with help from the debugger library; That's not quite what happens. These scripts get executed by forking the current bash process (without e

  1   2   3   4   5   >