Bug#741034: bash: Array slicing broken

[Jan Blunck]

Package: bash
Version: 4.2+dfsg-0.1
Severity: important
Tags: patch

Dear Maintainer,

This problem was also reported upstream:
http://lists.gnu.org/archive/html/bug-bash/2014-01/msg00050.html

Here is my script to reproduce:

 $ bash -c 'set -- "" ; echo $#; set -- "${@:2}"; echo $#'
 1
 0
 $ bash -c 'set -- "" ""; echo $#; set -- "${@:2}"; echo $#'
 2
 0
 $ bash -c 'set -- "" "" ""; echo $#; set -- "${@:2}"; echo $#'
 3
 2

This is with GNU bash, version 4.2.37(1)-release (x86_64-pc-linux-gnu).

The proposed patch is a backport of what went into 4.3-rc2 to fix the problem.

Regards,
Jan

-- System Information:
Debian Release: 7.4
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.2.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages bash depends on:
ii  base-files   7.1wheezy4
ii  dash         0.5.7-3
ii  debianutils  4.3.2
ii  libc6        2.13-38+deb7u1
ii  libtinfo5    5.9-10

Versions of packages bash recommends:
ii  bash-completion  1:2.0-1

Versions of packages bash suggests:
pn  bash-doc  <none>

-- no debconf information

Index: bash-4.2+dfsg/bash/subst.c
===================================================================
--- bash-4.2+dfsg.orig/bash/subst.c
+++ bash-4.2+dfsg/bash/subst.c
@@ -7238,7 +7238,9 @@ parameter_brace_expand (string, indexp,
 
       ret = alloc_word_desc ();
       ret->word = temp1;
-      if (temp1 && QUOTED_NULL (temp1) && (quoted & (Q_HERE_DOCUMENT|Q_DOUBLE_QUOTES)))
+      if (temp1 &&
+	  (quoted_dollar_atp == 0 || *quoted_dollar_atp == 0) &&
+	  QUOTED_NULL (temp1) && (quoted & (Q_HERE_DOCUMENT|Q_DOUBLE_QUOTES)))
 	ret->flags |= W_QUOTED|W_HASQUOTEDNULL;
       return ret;
     }
@@ -7258,7 +7260,9 @@ parameter_brace_expand (string, indexp,
       ret->word = temp1;
       ret = alloc_word_desc ();
       ret->word = temp1;
-      if (temp1 && QUOTED_NULL (temp1) && (quoted & (Q_HERE_DOCUMENT|Q_DOUBLE_QUOTES)))
+      if (temp1 &&
+	  (quoted_dollar_atp == 0 || *quoted_dollar_atp == 0) &&
+	  QUOTED_NULL (temp1) && (quoted & (Q_HERE_DOCUMENT|Q_DOUBLE_QUOTES)))
 	ret->flags |= W_QUOTED|W_HASQUOTEDNULL;
       return ret;
     }
@@ -7277,7 +7281,9 @@ parameter_brace_expand (string, indexp,
 
       ret = alloc_word_desc ();
       ret->word = temp1;
-      if (temp1 && QUOTED_NULL (temp1) && (quoted & (Q_HERE_DOCUMENT|Q_DOUBLE_QUOTES)))
+      if (temp1 &&
+	  (quoted_dollar_atp == 0 || *quoted_dollar_atp == 0) &&
+	  QUOTED_NULL (temp1) && (quoted & (Q_HERE_DOCUMENT|Q_DOUBLE_QUOTES)))
 	ret->flags |= W_QUOTED|W_HASQUOTEDNULL;
       return ret;
     }
@@ -7313,7 +7319,13 @@ parameter_brace_expand (string, indexp,
 
       ret = alloc_word_desc ();
       ret->word = temp1;
-      if (temp1 && QUOTED_NULL (temp1) && (quoted & (Q_HERE_DOCUMENT|Q_DOUBLE_QUOTES)))
+      /* We test quoted_dollar_atp because we want variants with double-quoted
+	 "$@" to take a different code path. In fact, we make sure at the end
+	 of expand_word_internal that we're only looking at these flags if
+	 quoted_dollar_at == 0. */
+      if (temp1 && 
+          (quoted_dollar_atp == 0 || *quoted_dollar_atp == 0) &&
+	  QUOTED_NULL (temp1) && (quoted & (Q_HERE_DOCUMENT|Q_DOUBLE_QUOTES)))
 	ret->flags |= W_QUOTED|W_HASQUOTEDNULL;
       return ret;