Blame SOURCES/bash-4.4-coverity.patch

3fb13f
diff --git a/builtins/fc.def b/builtins/fc.def
3fb13f
index fe16471..98c53db 100644
3fb13f
--- a/builtins/fc.def
3fb13f
+++ b/builtins/fc.def
3fb13f
@@ -423,6 +423,7 @@ fc_builtin (list)
3fb13f
     {
3fb13f
       sh_wrerror ();
3fb13f
       fclose (stream);
3fb13f
+      FREE (fn);
3fb13f
       return (EXECUTION_FAILURE);
3fb13f
     }
3fb13f
   fclose (stream);
3fb13f
diff --git a/execute_cmd.c b/execute_cmd.c
3fb13f
index 63a332a..15b5e19 100644
3fb13f
--- a/execute_cmd.c
3fb13f
+++ b/execute_cmd.c
3fb13f
@@ -2196,8 +2196,10 @@ coproc_setvars (cp)
3fb13f
   if (v == 0)
3fb13f
     {
3fb13f
       v = find_variable_nameref_for_create (cp->c_name, 1);
3fb13f
-      if (v == INVALID_NAMEREF_VALUE)
3fb13f
-	return;
3fb13f
+      if (v == INVALID_NAMEREF_VALUE) {
3fb13f
+        free (namevar);
3fb13f
+        return;
3fb13f
+      }
3fb13f
       if (v && nameref_p (v))
3fb13f
 	{
3fb13f
 	  free (cp->c_name);
3fb13f
@@ -2210,6 +2212,7 @@ coproc_setvars (cp)
3fb13f
     {
3fb13f
       if (readonly_p (v))
3fb13f
 	err_readonly (cp->c_name);
3fb13f
+      free (namevar);
3fb13f
       return;
3fb13f
     }
3fb13f
   if (v == 0)
3fb13f
@@ -5528,7 +5531,6 @@ shell_execve (command, args, env)
3fb13f
 	      char *interp;
3fb13f
 	      int ilen;
3fb13f
 
3fb13f
-              close (fd);
3fb13f
 	      interp = getinterp (sample, sample_len, (int *)NULL);
3fb13f
 	      ilen = strlen (interp);
3fb13f
 	      errno = i;
3fb13f
diff --git a/expr.c b/expr.c
3fb13f
index 172964a..5dc57c0 100644
3fb13f
--- a/expr.c
3fb13f
+++ b/expr.c
3fb13f
@@ -207,7 +207,8 @@ static intmax_t exp5 __P((void));
3fb13f
 static intmax_t exp4 __P((void));
3fb13f
 static intmax_t expshift __P((void));
3fb13f
 static intmax_t exp3 __P((void));
3fb13f
-static intmax_t exp2 __P((void));
3fb13f
+/* Avoid name clash with standard exp2 */
3fb13f
+static intmax_t bash_exp2 __P((void));
3fb13f
 static intmax_t	exppower __P((void));
3fb13f
 static intmax_t exp1 __P((void));
3fb13f
 static intmax_t exp0 __P((void));
3fb13f
@@ -809,14 +810,14 @@ exp3 ()
3fb13f
 {
3fb13f
   register intmax_t val1, val2;
3fb13f
 
3fb13f
-  val1 = exp2 ();
3fb13f
+  val1 = bash_exp2 ();
3fb13f
 
3fb13f
   while ((curtok == PLUS) || (curtok == MINUS))
3fb13f
     {
3fb13f
       int op = curtok;
3fb13f
 
3fb13f
       readtok ();
3fb13f
-      val2 = exp2 ();
3fb13f
+      val2 = bash_exp2 ();
3fb13f
 
3fb13f
       if (op == PLUS)
3fb13f
 	val1 += val2;
3fb13f
@@ -828,7 +829,7 @@ exp3 ()
3fb13f
 }
3fb13f
 
3fb13f
 static intmax_t
3fb13f
-exp2 ()
3fb13f
+bash_exp2 ()
3fb13f
 {
3fb13f
   register intmax_t val1, val2;
3fb13f
 #if defined (HAVE_IMAXDIV)
3fb13f
diff --git a/lib/glob/glob.c b/lib/glob/glob.c
3fb13f
index 7f6eafe..c018e29 100644
3fb13f
--- a/lib/glob/glob.c
3fb13f
+++ b/lib/glob/glob.c
3fb13f
@@ -576,7 +576,7 @@ glob_vector (pat, dir, flags)
3fb13f
   register char *nextname, *npat, *subdir;
3fb13f
   unsigned int count;
3fb13f
   int lose, skip, ndirs, isdir, sdlen, add_current, patlen;
3fb13f
-  register char **name_vector;
3fb13f
+  register char **name_vector = NULL;
3fb13f
   register unsigned int i;
3fb13f
   int mflags;		/* Flags passed to strmatch (). */
3fb13f
   int pflags;		/* flags passed to sh_makepath () */
3fb13f
@@ -894,7 +894,7 @@ glob_vector (pat, dir, flags)
3fb13f
 	}
3fb13f
 
3fb13f
       /* Don't call QUIT; here; let higher layers deal with it. */
3fb13f
-
3fb13f
+      FREE (name_vector);
3fb13f
       return ((char **)NULL);
3fb13f
     }
3fb13f
 
3fb13f
diff --git a/lib/sh/pathcanon.c b/lib/sh/pathcanon.c
3fb13f
index f19bd55..2a565d6 100644
3fb13f
--- a/lib/sh/pathcanon.c
3fb13f
+++ b/lib/sh/pathcanon.c
3fb13f
@@ -227,7 +227,7 @@ sh_canonpath (path, flags)
3fb13f
       if (result[2] == '\0')	/* short-circuit for bare `//' */
3fb13f
 	result[1] = '\0';
3fb13f
       else
3fb13f
-	strcpy (result, result + 1);
3fb13f
+	memmove(result, result + 1, strlen(result + 1) + 1);
3fb13f
     }
3fb13f
 
3fb13f
   return (result);
3fb13f
diff --git a/lib/sh/pathphys.c b/lib/sh/pathphys.c
3fb13f
index 26016b7..b64c4cd 100644
3fb13f
--- a/lib/sh/pathphys.c
3fb13f
+++ b/lib/sh/pathphys.c
3fb13f
@@ -245,7 +245,7 @@ error:
3fb13f
       if (result[2] == '\0')	/* short-circuit for bare `//' */
3fb13f
 	result[1] = '\0';
3fb13f
       else
3fb13f
-	strcpy (result, result + 1);
3fb13f
+	memmove(result, result + 1, strlen(result + 1) + 1);
3fb13f
     }
3fb13f
 
3fb13f
   return (result);
3fb13f
diff --git a/shell.c b/shell.c
3fb13f
index b43de50..4aae182 100644
3fb13f
--- a/shell.c
3fb13f
+++ b/shell.c
3fb13f
@@ -1948,8 +1948,10 @@ show_shell_usage (fp, extra)
3fb13f
   fputs (_("\t-ilrsD or -c command or -O shopt_option\t\t(invocation only)\n"), fp);
3fb13f
 
3fb13f
   for (i = 0, set_opts = 0; shell_builtins[i].name; i++)
3fb13f
-    if (STREQ (shell_builtins[i].name, "set"))
3fb13f
+    if (STREQ (shell_builtins[i].name, "set")) {
3fb13f
       set_opts = savestring (shell_builtins[i].short_doc);
3fb13f
+      break;
3fb13f
+    }
3fb13f
   if (set_opts)
3fb13f
     {
3fb13f
       s = strchr (set_opts, '[');
3fb13f
diff --git a/subst.c b/subst.c
3fb13f
index 5f3e41e..7574617 100644
3fb13f
--- a/subst.c
3fb13f
+++ b/subst.c
3fb13f
@@ -5182,8 +5182,11 @@ parameter_list_transform (xc, itype, quoted)
3fb13f
   list = list_rest_of_args ();
3fb13f
   if (list == 0)
3fb13f
     return ((char *)NULL);
3fb13f
-  if (xc == 'A')
3fb13f
-    return (pos_params_assignment (list, itype, quoted));
3fb13f
+  if (xc == 'A') {
3fb13f
+      ret = pos_params_assignment (list, itype, quoted);
3fb13f
+      dispose_words (list);
3fb13f
+      return (ret);
3fb13f
+  }
3fb13f
   ret = list_transform (xc, (SHELL_VAR *)0, list, itype, quoted);
3fb13f
   dispose_words (list);
3fb13f
   return (ret);
3fb13f
@@ -6813,6 +6816,7 @@ parameter_brace_expand_rhs (name, value, c, quoted, pflags, qdollaratp, hasdolla
3fb13f
 	{
3fb13f
 	  report_error (_("%s: invalid indirect expansion"), name);
3fb13f
 	  free (vname);
3fb13f
+      free (t1);
3fb13f
 	  dispose_word (w);
3fb13f
 	  return &expand_wdesc_error;
3fb13f
 	}
3fb13f
@@ -6820,6 +6824,7 @@ parameter_brace_expand_rhs (name, value, c, quoted, pflags, qdollaratp, hasdolla
3fb13f
 	{
3fb13f
 	  report_error (_("%s: invalid variable name"), vname);
3fb13f
 	  free (vname);
3fb13f
+      free (t1);
3fb13f
 	  dispose_word (w);
3fb13f
 	  return &expand_wdesc_error;
3fb13f
 	}
3fb13f
diff --git a/support/man2html.c b/support/man2html.c
3fb13f
index 6ba5061..1d9e376 100644
3fb13f
--- a/support/man2html.c
3fb13f
+++ b/support/man2html.c
3fb13f
@@ -522,6 +522,7 @@ read_man_page(char *filename)
3fb13f
 			man_buf[buf_size] = '\n';
3fb13f
 			man_buf[buf_size + 1] = man_buf[buf_size + 2] = '\0';
3fb13f
 		} else {
3fb13f
+            free (man_buf);
3fb13f
 			man_buf = NULL;
3fb13f
 		}
3fb13f
 		fclose(man_stream);
3fb13f
@@ -2562,7 +2563,6 @@ scan_request(char *c)
3fb13f
 					h = name;
3fb13f
 				if (stat(h, &stbuf) != -1)
3fb13f
 					l = stbuf.st_size;
3fb13f
-				buf = stralloc(l + 4);
3fb13f
 #if NOCGI
3fb13f
 				if (!out_length) {
3fb13f
 					char   *t, *s;