From 9cb94f590b095a09e47b1c74a6d3e917ca2b6444 Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Sep 13 2022 07:39:19 +0000
Subject: import ksh-20120801-255.el8_6


---

diff --git a/SOURCES/ksh-20120801-signal-bubbling.patch b/SOURCES/ksh-20120801-signal-bubbling.patch
new file mode 100644
index 0000000..80c3eb0
--- /dev/null
+++ b/SOURCES/ksh-20120801-signal-bubbling.patch
@@ -0,0 +1,12 @@
+diff --git a/src/cmd/ksh93/sh/xec.c b/src/cmd/ksh93/sh/xec.c
+--- a/src/cmd/ksh93/sh/xec.c
++++ b/src/cmd/ksh93/sh/xec.c
+@@ -3529,7 +3529,7 @@ int sh_funscope(int argn, char *argv[],int(*fun)(void*),void *arg,int execflg)
+ 	}
+ 	if(jmpval)
+ 		r=shp->exitval;
+-	if(r>SH_EXITSIG && ((r&SH_EXITMASK)==SIGINT || ((r&SH_EXITMASK)==SIGQUIT)))
++	if(r>SH_EXITSIG && ((r&SH_EXITMASK)==SIGINT || ((r&SH_EXITMASK)==SIGQUIT) || (getenv("_AST_KSH_SIGNAL_BUBBLE"))))
+ 		kill(getpid(),r&SH_EXITMASK);
+ 	if(jmpval > SH_JMPFUN)
+ 	{
diff --git a/SPECS/ksh.spec b/SPECS/ksh.spec
index fe1adb8..60d9709 100644
--- a/SPECS/ksh.spec
+++ b/SPECS/ksh.spec
@@ -6,7 +6,7 @@ Summary:      The Original ATT Korn Shell
 URL:          http://www.kornshell.com/
 License:      EPL
 Version:      %{releasedate}
-Release:      254%{?dist}
+Release:      255%{?dist}
 Source0:      http://www.research.att.com/~gsf/download/tgz/ast-ksh.%{release_date}.tgz
 Source1:      http://www.research.att.com/~gsf/download/tgz/INIT.%{release_date}.tgz
 Source2:      kshcomp.conf
@@ -217,6 +217,9 @@ Patch88: ksh-20120801-annocheck.patch
 # rhbz#1790547
 Patch89: ksh-20120801-cve-2019-14868.patch
 
+# rhbz#2109589
+Patch90: ksh-20120801-signal-bubbling.patch
+
 Conflicts:    pdksh
 Requires: coreutils, diffutils, chkconfig
 BuildRequires: bison
@@ -369,6 +372,10 @@ fi
 %config(noreplace) %{_sysconfdir}/binfmt.d/kshcomp.conf
 
 %changelog
+* Thu Jul 21 2022 Vincent Mihalkovic <vmihalko@redhat.com> - 20120801-255
+- Do not evaluate arithmetic expressions from environment variables at startup
+  Resolves: #2109589
+
 * Thu Feb 06 2020 Siteshwar Vashisht <svashisht@redhat.com> - 20120801-254
 - Bump version number to avoid breaking upgrade path