out-of-bound read in brackmatch function in "sm_loop.c"

2016-11-02 Thread op7ic \x00
Machine: x86_64 OS: linux-gnu Compiler: gcc Compilation CFLAGS: -DPROGRAM='bash' -DCONF_HOSTTYPE='x86_64' -DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='x86_64-unknown-linux-gnu' -DCONF_VENDOR='unknown' -DLOCALEDIR='/usr/share/locale' -DPACKAGE='bash' -DSHELL -DHAVE_CONFIG_H -I. -I. -I./include -I.

Re: 4.4: crash in redir10 test; use after free?

2016-11-02 Thread Chet Ramey
On 11/1/16 12:03 PM, Christian Weisgerber wrote: > Running the bash 4.4 regression test suite on OpenBSD/amd64, I noticed > a crash in the redir tests. Specifically, running redir10.sub with > bash 4.4 causes it to die with a bus error most of the time. Thanks for the report. I can't reproduce t

Re: out-of-bound read in brackmatch function in "sm_loop.c"

2016-11-02 Thread Chet Ramey
On 11/2/16 8:06 AM, op7ic \x00 wrote: > Bash Version: 4.4 > Patch Level: 0 > Release Status: release > > Description: > > A out-of-bound read was identified in "brackmatch" function in > "sm_loop.c" source file when parsing specially crafted bash source > file. The impact is low and will just re

Re: 4.4: crash in redir10 test; use after free?

2016-11-02 Thread Christian Weisgerber
Chet Ramey: > > Running the bash 4.4 regression test suite on OpenBSD/amd64, I noticed > > a crash in the redir tests. Specifically, running redir10.sub with > > bash 4.4 causes it to die with a bus error most of the time. > > Thanks for the report. I can't reproduce this, Here's the backtrace

Re: 4.4: crash in redir10 test; use after free?

2016-11-02 Thread Chet Ramey
On 11/2/16 5:51 PM, Christian Weisgerber wrote: > Chet Ramey: > >>> Running the bash 4.4 regression test suite on OpenBSD/amd64, I noticed >>> a crash in the redir tests. Specifically, running redir10.sub with >>> bash 4.4 causes it to die with a bus error most of the time. >> >> Thanks for the r

shell-expand-line drops quotation marks [FIXED]

2016-11-02 Thread Dabrien 'Dabe' Murphy
[NOTE] Below is a message I started to write listing a whole slew of cases where `shell-expand-line` didn't Do What I Mean. After familiarizing myself with the source code, however, I was pleasantly surprised to discover that there's actually a one line one character fix for almost every case