summaryrefslogtreecommitdiff
path: root/data/bash/bash44-003
diff options
context:
space:
mode:
Diffstat (limited to 'data/bash/bash44-003')
-rw-r--r--data/bash/bash44-00358
1 files changed, 58 insertions, 0 deletions
diff --git a/data/bash/bash44-003 b/data/bash/bash44-003
new file mode 100644
index 000000000..01b6b6c9d
--- /dev/null
+++ b/data/bash/bash44-003
@@ -0,0 +1,58 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 4.4
+Patch-ID: bash44-003
+
+Bug-Reported-by: op7ic \x00 <op7ica@gmail.com>
+Bug-Reference-ID: <CAFHyJTopWC5Jx+U7WcvxSZKu+KrqSf+_3sHPiRWo=VzXSiPq=w@mail.gmail.com>
+Bug-Reference-URL: http://lists.gnu.org/archive/html/bug-bash/2016-11/msg00005.html
+
+Bug-Description:
+
+Specially-crafted input, in this case an incomplete pathname expansion
+bracket expression containing an invalid collating symbol, can cause the
+shell to crash.
+
+Patch (apply with `patch -p0'):
+
+*** ../bash-4.4/lib/glob/sm_loop.c 2016-04-10 11:23:21.000000000 -0400
+--- lib/glob/sm_loop.c 2016-11-02 14:03:34.000000000 -0400
+***************
+*** 331,334 ****
+--- 331,340 ----
+ if (p[pc] == L('.') && p[pc+1] == L(']'))
+ break;
++ if (p[pc] == 0)
++ {
++ if (vp)
++ *vp = INVALID;
++ return (p + pc);
++ }
+ val = COLLSYM (p, pc);
+ if (vp)
+***************
+*** 484,487 ****
+--- 490,496 ----
+ c = FOLD (c);
+
++ if (c == L('\0'))
++ return ((test == L('[')) ? savep : (CHAR *)0);
++
+ if ((flags & FNM_PATHNAME) && c == L('/'))
+ /* [/] can never match when matching a pathname. */
+*** ../bash-4.4/patchlevel.h 2016-06-22 14:51:03.000000000 -0400
+--- patchlevel.h 2016-10-01 11:01:28.000000000 -0400
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 2
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 3
+
+ #endif /* _PATCHLEVEL_H_ */