BASH PATCH REPORT
=================
Bash-Release: 5.3
Patch-ID: bash53-009
Bug-Reported-by: penguin p <[email protected]>
Bug-Reference-ID:
<tyypr01mb14049c63d4635628ee867664bfa...@tyypr01mb14049.jpnprd01.prod.outlook.com>
Bug-Reference-URL:
https://lists.gnu.org/archive/html/bug-bash/2025-08/msg00080.html
Bug-Description:
A SIGINT during a reverse i-search can cause a segmentation fault due to
accessing data freed by a signal handler.
Patch (apply with `patch -p0'):
*** ../bash-20250807/lib/readline/input.c Tue Jul 8 15:37:13 2025
--- lib/readline/input.c Fri Aug 22 15:04:05 2025
***************
*** 976,984 ****
if (rl_signal_event_hook)
(*rl_signal_event_hook) ();
! #if defined (READLINE_CALLBACKS)
! else if (osig == SIGINT && (ostate & RL_STATE_CALLBACK) && (ostate &
(RL_STATE_ISEARCH|RL_STATE_NSEARCH|RL_STATE_NUMERICARG)))
/* just these cases for now */
_rl_abort_internal ();
- #endif
}
}
--- 1004,1012 ----
if (rl_signal_event_hook)
(*rl_signal_event_hook) ();
! /* If the application's SIGINT handler returns, make sure we abort out
of
! searches and numeric arguments because we've freed necessary state. */
! if (osig == SIGINT && (ostate &
(RL_STATE_ISEARCH|RL_STATE_NSEARCH|RL_STATE_NUMERICARG)))
/* just these cases for now */
_rl_abort_internal ();
}
}
*** ../bash-20250807/lib/readline/isearch.c Thu Jun 5 09:22:11 2025
--- lib/readline/isearch.c Tue Aug 19 14:55:55 2025
***************
*** 890,899 ****
_rl_isearch_cleanup (_rl_search_cxt *cxt, int r)
{
if (r >= 0)
_rl_isearch_fini (cxt);
_rl_scxt_dispose (cxt, 0);
- _rl_iscxt = 0;
-
- RL_UNSETSTATE(RL_STATE_ISEARCH);
return (r != 0);
--- 890,901 ----
_rl_isearch_cleanup (_rl_search_cxt *cxt, int r)
{
+ RL_UNSETSTATE(RL_STATE_ISEARCH);
+ if (cxt == 0)
+ return (r != 0);
+
+ _rl_iscxt = 0;
if (r >= 0)
_rl_isearch_fini (cxt);
_rl_scxt_dispose (cxt, 0);
return (r != 0);
*** ../bash-5.3/patchlevel.h 2020-06-22 14:51:03.000000000 -0400
--- patchlevel.h 2020-10-01 11:01:28.000000000 -0400
***************
*** 26,30 ****
looks for to find the patch level (for the sccs version string). */
! #define PATCHLEVEL 8
#endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
looks for to find the patch level (for the sccs version string). */
! #define PATCHLEVEL 9
#endif /* _PATCHLEVEL_H_ */
--
``The lyf so short, the craft so long to lerne.'' - Chaucer
``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, UTech, CWRU [email protected] http://tiswww.cwru.edu/~chet/
