From 13131778484f9de2b192985a0ea237d186e8f35f Mon Sep 17 00:00:00 2001
From: Kamil Dudka <kdudka@redhat.com>
Date: Mar 06 2018 15:24:14 +0000
Subject: Resolves: CVE-2018-7549 - avoid crash when copying empty hash table


---

diff --git a/0005-zsh-5.4.2-CVE-2018-7549.patch b/0005-zsh-5.4.2-CVE-2018-7549.patch
new file mode 100644
index 0000000..6dfafe8
--- /dev/null
+++ b/0005-zsh-5.4.2-CVE-2018-7549.patch
@@ -0,0 +1,38 @@
+From 016b8889a6c30279f6ee362e34262c204ef834c2 Mon Sep 17 00:00:00 2001
+From: Stephane Chazelas <stephane.chazelas@gmail.com>
+Date: Fri, 22 Dec 2017 22:17:09 +0000
+Subject: [PATCH 2/2] Avoid crash copying empty hash table.
+
+Visible with typeset -p.
+
+Upstream-commit: c2cc8b0fbefc9868fa83537f5b6d90fc1ec438dd
+Signed-off-by: Kamil Dudka <kdudka@redhat.com>
+---
+ Src/params.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/Src/params.c b/Src/params.c
+index 9c7833f..d9da7f6 100644
+--- a/Src/params.c
++++ b/Src/params.c
+@@ -549,10 +549,13 @@ scancopyparams(HashNode hn, UNUSED(int flags))
+ HashTable
+ copyparamtable(HashTable ht, char *name)
+ {
+-    HashTable nht = newparamtable(ht->hsize, name);
+-    outtable = nht;
+-    scanhashtable(ht, 0, 0, 0, scancopyparams, 0);
+-    outtable = NULL;
++    HashTable nht = 0;
++    if (ht) {
++	nht = newparamtable(ht->hsize, name);
++	outtable = nht;
++	scanhashtable(ht, 0, 0, 0, scancopyparams, 0);
++	outtable = NULL;
++    }
+     return nht;
+ }
+ 
+-- 
+2.14.3
+
diff --git a/zsh.spec b/zsh.spec
index db8f5c0..aa4a9d5 100644
--- a/zsh.spec
+++ b/zsh.spec
@@ -19,6 +19,9 @@ Patch1:  0001-zsh-5.4.2-funcnest.patch
 # avoid NULL dereference when using ${(PA)...} on an empty array (CVE-2018-7548)
 Patch4:  0004-zsh-5.4.2-CVE-2018-7548.patch
 
+# avoid crash when copying empty hash table (CVE-2018-7549)
+Patch5:  0005-zsh-5.4.2-CVE-2018-7549.patch
+
 BuildRequires: autoconf
 BuildRequires: coreutils
 BuildRequires: gawk
@@ -175,6 +178,7 @@ fi
 
 %changelog
 * Tue Mar 06 2018 Kamil Dudka <kdudka@redhat.com> - 5.4.2-7
+- avoid crash when copying empty hash table (CVE-2018-7549)
 - avoid NULL dereference when using ${(PA)...} on an empty array (CVE-2018-7548)
 
 * Mon Feb 19 2018 Kamil Dudka <kdudka@redhat.com> - 5.4.2-6