On 2/13/14 2:32 PM, Eduardo A. Bustamante López wrote:
> On Thu, Feb 13, 2014 at 11:37:27AM -0500, Chet Ramey wrote:
>> On 2/13/14 11:33 AM, Eduardo A. Bustamante López wrote:
>>> Using an invalid byte sequence with printf %q segfaults bash, for a
>>> UTF-8 locale.

I think it depends on your system and locale.  I only had the third
example produce a seg fault, but it was enough.  Try the attached
updated patch.

Chet

-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, ITS, CWRU    c...@case.edu    http://cnswww.cns.cwru.edu/~chet/
*** ../bash-4.3-rc2/lib/sh/strtrans.c	2013-03-09 14:55:18.000000000 -0500
--- lib/sh/strtrans.c	2014-02-13 15:23:29.000000000 -0500
***************
*** 258,262 ****
  	  b = is_basic (c);
  	  /* XXX - clen comparison to 0 is dicey */
! 	  if ((b == 0 && ((clen = mbrtowc (&wc, s, MB_CUR_MAX, 0)) < 0 || iswprint (wc) == 0)) ||
  	      (b == 1 && ISPRINT (c) == 0))
  #else
--- 258,262 ----
  	  b = is_basic (c);
  	  /* XXX - clen comparison to 0 is dicey */
! 	  if ((b == 0 && ((clen = mbrtowc (&wc, s, MB_CUR_MAX, 0)) < 0 || MB_INVALIDCH (clen) || iswprint (wc) == 0)) ||
  	      (b == 1 && ISPRINT (c) == 0))
  #else
***************
*** 279,284 ****
  	*r++ = c;
        else
! 	for (b = 0; b < (int)clen; c = b ? *++s : c)
! 	  *r++ = c;
      }
  
--- 279,287 ----
  	*r++ = c;
        else
! 	{
! 	  for (b = 0; b < (int)clen; b++)
! 	    *r++ = (unsigned char)s[b];
! 	  s += clen - 1;	/* -1 because of the increment above */
! 	}
      }
  

Reply via email to