07a490
			     BASH PATCH REPORT
07a490
			     =================
07a490
07a490
Bash-Release:	4.2
07a490
Patch-ID:	bash42-003
07a490
07a490
Bug-Reported-by:	Clark J. Wang <dearvoid@gmail.com>
07a490
Bug-Reference-ID:	<AANLkTikZ_rVV-frR8Fh0PzhXnMKnm5XsUR-F3qtPPs5G@mail.gmail.com>
07a490
Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2011-02/msg00136.html
07a490
07a490
Bug-Description:
07a490
07a490
When using the pattern replacement and pattern removal word expansions, bash
07a490
miscalculates the possible match length in the presence of an unescaped left
07a490
bracket without a closing right bracket, resulting in a failure to match
07a490
the pattern.
07a490
07a490
Patch (apply with `patch -p0'):
07a490
07a490
*** ../bash-4.2-patched/lib/glob/gmisc.c	2011-02-05 16:11:17.000000000 -0500
07a490
--- lib/glob/gmisc.c	2011-02-18 23:53:42.000000000 -0500
07a490
***************
07a490
*** 78,83 ****
07a490
       size_t wmax;
07a490
  {
07a490
!   wchar_t wc, *wbrack;
07a490
!   int matlen, t, in_cclass, in_collsym, in_equiv;
07a490
  
07a490
    if (*wpat == 0)
07a490
--- 78,83 ----
07a490
       size_t wmax;
07a490
  {
07a490
!   wchar_t wc;
07a490
!   int matlen, bracklen, t, in_cclass, in_collsym, in_equiv;
07a490
  
07a490
    if (*wpat == 0)
07a490
***************
07a490
*** 119,123 ****
07a490
  	case L'[':
07a490
  	  /* scan for ending `]', skipping over embedded [:...:] */
07a490
! 	  wbrack = wpat;
07a490
  	  wc = *wpat++;
07a490
  	  do
07a490
--- 119,123 ----
07a490
  	case L'[':
07a490
  	  /* scan for ending `]', skipping over embedded [:...:] */
07a490
! 	  bracklen = 1;
07a490
  	  wc = *wpat++;
07a490
  	  do
07a490
***************
07a490
*** 125,140 ****
07a490
  	      if (wc == 0)
07a490
  		{
07a490
! 	          matlen += wpat - wbrack - 1;	/* incremented below */
07a490
! 	          break;
07a490
  	        }
07a490
  	      else if (wc == L'\\')
07a490
  		{
07a490
! 		  wc = *wpat++;
07a490
! 		  if (*wpat == 0)
07a490
! 		    break;
07a490
  		}
07a490
  	      else if (wc == L'[' && *wpat == L':')	/* character class */
07a490
  		{
07a490
  		  wpat++;
07a490
  		  in_cclass = 1;
07a490
  		}
07a490
--- 125,148 ----
07a490
  	      if (wc == 0)
07a490
  		{
07a490
! 		  wpat--;			/* back up to NUL */
07a490
! 	          matlen += bracklen;
07a490
! 	          goto bad_bracket;
07a490
  	        }
07a490
  	      else if (wc == L'\\')
07a490
  		{
07a490
! 		  /* *wpat == backslash-escaped character */
07a490
! 		  bracklen++;
07a490
! 		  /* If the backslash or backslash-escape ends the string,
07a490
! 		     bail.  The ++wpat skips over the backslash escape */
07a490
! 		  if (*wpat == 0 || *++wpat == 0)
07a490
! 		    {
07a490
! 		      matlen += bracklen;
07a490
! 		      goto bad_bracket;
07a490
! 		    }
07a490
  		}
07a490
  	      else if (wc == L'[' && *wpat == L':')	/* character class */
07a490
  		{
07a490
  		  wpat++;
07a490
+ 		  bracklen++;
07a490
  		  in_cclass = 1;
07a490
  		}
07a490
***************
07a490
*** 142,145 ****
07a490
--- 150,154 ----
07a490
  		{
07a490
  		  wpat++;
07a490
+ 		  bracklen++;
07a490
  		  in_cclass = 0;
07a490
  		}
07a490
***************
07a490
*** 147,152 ****
07a490
  		{
07a490
  		  wpat++;
07a490
  		  if (*wpat == L']')	/* right bracket can appear as collating symbol */
07a490
! 		    wpat++;
07a490
  		  in_collsym = 1;
07a490
  		}
07a490
--- 156,165 ----
07a490
  		{
07a490
  		  wpat++;
07a490
+ 		  bracklen++;
07a490
  		  if (*wpat == L']')	/* right bracket can appear as collating symbol */
07a490
! 		    {
07a490
! 		      wpat++;
07a490
! 		      bracklen++;
07a490
! 		    }
07a490
  		  in_collsym = 1;
07a490
  		}
07a490
***************
07a490
*** 154,157 ****
07a490
--- 167,171 ----
07a490
  		{
07a490
  		  wpat++;
07a490
+ 		  bracklen++;
07a490
  		  in_collsym = 0;
07a490
  		}
07a490
***************
07a490
*** 159,164 ****
07a490
  		{
07a490
  		  wpat++;
07a490
  		  if (*wpat == L']')	/* right bracket can appear as equivalence class */
07a490
! 		    wpat++;
07a490
  		  in_equiv = 1;
07a490
  		}
07a490
--- 173,182 ----
07a490
  		{
07a490
  		  wpat++;
07a490
+ 		  bracklen++;
07a490
  		  if (*wpat == L']')	/* right bracket can appear as equivalence class */
07a490
! 		    {
07a490
! 		      wpat++;
07a490
! 		      bracklen++;
07a490
! 		    }
07a490
  		  in_equiv = 1;
07a490
  		}
07a490
***************
07a490
*** 166,174 ****
07a490
--- 184,196 ----
07a490
  		{
07a490
  		  wpat++;
07a490
+ 		  bracklen++;
07a490
  		  in_equiv = 0;
07a490
  		}
07a490
+ 	      else
07a490
+ 		bracklen++;
07a490
  	    }
07a490
  	  while ((wc = *wpat++) != L']');
07a490
  	  matlen++;		/* bracket expression can only match one char */
07a490
+ bad_bracket:
07a490
  	  break;
07a490
  	}
07a490
***************
07a490
*** 214,219 ****
07a490
       size_t max;
07a490
  {
07a490
!   char c, *brack;
07a490
!   int matlen, t, in_cclass, in_collsym, in_equiv;
07a490
  
07a490
    if (*pat == 0)
07a490
--- 236,241 ----
07a490
       size_t max;
07a490
  {
07a490
!   char c;
07a490
!   int matlen, bracklen, t, in_cclass, in_collsym, in_equiv;
07a490
  
07a490
    if (*pat == 0)
07a490
***************
07a490
*** 255,259 ****
07a490
  	case '[':
07a490
  	  /* scan for ending `]', skipping over embedded [:...:] */
07a490
! 	  brack = pat;
07a490
  	  c = *pat++;
07a490
  	  do
07a490
--- 277,281 ----
07a490
  	case '[':
07a490
  	  /* scan for ending `]', skipping over embedded [:...:] */
07a490
! 	  bracklen = 1;
07a490
  	  c = *pat++;
07a490
  	  do
07a490
***************
07a490
*** 261,276 ****
07a490
  	      if (c == 0)
07a490
  		{
07a490
! 	          matlen += pat - brack - 1;	/* incremented below */
07a490
! 	          break;
07a490
  	        }
07a490
  	      else if (c == '\\')
07a490
  		{
07a490
! 		  c = *pat++;
07a490
! 		  if (*pat == 0)
07a490
! 		    break;
07a490
  		}
07a490
  	      else if (c == '[' && *pat == ':')	/* character class */
07a490
  		{
07a490
  		  pat++;
07a490
  		  in_cclass = 1;
07a490
  		}
07a490
--- 283,306 ----
07a490
  	      if (c == 0)
07a490
  		{
07a490
! 		  pat--;			/* back up to NUL */
07a490
! 		  matlen += bracklen;
07a490
! 		  goto bad_bracket;
07a490
  	        }
07a490
  	      else if (c == '\\')
07a490
  		{
07a490
! 		  /* *pat == backslash-escaped character */
07a490
! 		  bracklen++;
07a490
! 		  /* If the backslash or backslash-escape ends the string,
07a490
! 		     bail.  The ++pat skips over the backslash escape */
07a490
! 		  if (*pat == 0 || *++pat == 0)
07a490
! 		    {
07a490
! 		      matlen += bracklen;
07a490
! 		      goto bad_bracket;
07a490
! 		    }
07a490
  		}
07a490
  	      else if (c == '[' && *pat == ':')	/* character class */
07a490
  		{
07a490
  		  pat++;
07a490
+ 		  bracklen++;
07a490
  		  in_cclass = 1;
07a490
  		}
07a490
***************
07a490
*** 278,281 ****
07a490
--- 308,312 ----
07a490
  		{
07a490
  		  pat++;
07a490
+ 		  bracklen++;
07a490
  		  in_cclass = 0;
07a490
  		}
07a490
***************
07a490
*** 283,288 ****
07a490
  		{
07a490
  		  pat++;
07a490
  		  if (*pat == ']')	/* right bracket can appear as collating symbol */
07a490
! 		    pat++;
07a490
  		  in_collsym = 1;
07a490
  		}
07a490
--- 314,323 ----
07a490
  		{
07a490
  		  pat++;
07a490
+ 		  bracklen++;
07a490
  		  if (*pat == ']')	/* right bracket can appear as collating symbol */
07a490
! 		    {
07a490
! 		      pat++;
07a490
! 		      bracklen++;
07a490
! 		    }
07a490
  		  in_collsym = 1;
07a490
  		}
07a490
***************
07a490
*** 290,293 ****
07a490
--- 325,329 ----
07a490
  		{
07a490
  		  pat++;
07a490
+ 		  bracklen++;
07a490
  		  in_collsym = 0;
07a490
  		}
07a490
***************
07a490
*** 295,300 ****
07a490
  		{
07a490
  		  pat++;
07a490
  		  if (*pat == ']')	/* right bracket can appear as equivalence class */
07a490
! 		    pat++;
07a490
  		  in_equiv = 1;
07a490
  		}
07a490
--- 331,340 ----
07a490
  		{
07a490
  		  pat++;
07a490
+ 		  bracklen++;
07a490
  		  if (*pat == ']')	/* right bracket can appear as equivalence class */
07a490
! 		    {
07a490
! 		      pat++;
07a490
! 		      bracklen++;
07a490
! 		    }
07a490
  		  in_equiv = 1;
07a490
  		}
07a490
***************
07a490
*** 302,310 ****
07a490
--- 342,354 ----
07a490
  		{
07a490
  		  pat++;
07a490
+ 		  bracklen++;
07a490
  		  in_equiv = 0;
07a490
  		}
07a490
+ 	      else
07a490
+ 		bracklen++;
07a490
  	    }
07a490
  	  while ((c = *pat++) != ']');
07a490
  	  matlen++;		/* bracket expression can only match one char */
07a490
+ bad_bracket:
07a490
  	  break;
07a490
  	}
07a490
*** ../bash-4.2-patched/patchlevel.h	Sat Jun 12 20:14:48 2010
07a490
--- patchlevel.h	Thu Feb 24 21:41:34 2011
07a490
***************
07a490
*** 26,30 ****
07a490
     looks for to find the patch level (for the sccs version string). */
07a490
  
07a490
! #define PATCHLEVEL 2
07a490
  
07a490
  #endif /* _PATCHLEVEL_H_ */
07a490
--- 26,30 ----
07a490
     looks for to find the patch level (for the sccs version string). */
07a490
  
07a490
! #define PATCHLEVEL 3
07a490
  
07a490
  #endif /* _PATCHLEVEL_H_ */