			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-001

Bug-Reported-by:	NBaH <nbah@sfr.fr>
Bug-Reference-ID:	<ler0b5$iu9$1@speranza.aioe.org>
Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2014-02/msg00092.html

Bug-Description:

A missing check for a valid option prevented `test -R' from working.  There
is another problem that causes bash to look up the wrong variable name when
processing the argument to `test -R'.

Patch (apply with `patch -p0'):

*** ../bash-4.3/test.c	2014-02-04 16:52:58.000000000 -0500
--- test.c	2014-02-28 21:22:44.000000000 -0500
***************
*** 647,652 ****
  
      case 'R':
!       v = find_variable (arg);
!       return (v && invisible_p (v) == 0 && var_isset (v) && nameref_p (v) ? TRUE : FALSE);
      }
  
--- 647,652 ----
  
      case 'R':
!       v = find_variable_noref (arg);
!       return ((v && invisible_p (v) == 0 && var_isset (v) && nameref_p (v)) ? TRUE : FALSE);
      }
  
***************
*** 724,727 ****
--- 724,728 ----
      case 'u': case 'v': case 'w': case 'x': case 'z':
      case 'G': case 'L': case 'O': case 'S': case 'N':
+     case 'R':
        return (1);
      }
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 0
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 1
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-002

Bug-Reported-by:	Moe Tunes <moetunes42@gmail.com>
Bug-Reference-ID:	<53103F49.3070100@gmail.com>
Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2014-02/msg00086.html

Bug-Description:

A change to save state while running the DEBUG trap caused pipelines to hang
on systems which need process group synchronization while building pipelines.

Patch (apply with `patch -p0'):

*** ../bash-4.3/trap.c	2014-02-05 10:03:21.000000000 -0500
--- trap.c	2014-02-28 09:51:43.000000000 -0500
***************
*** 921,925 ****
  
  #if defined (JOB_CONTROL)
!       save_pipeline (1);	/* XXX only provides one save level */
  #endif
  
--- 921,926 ----
  
  #if defined (JOB_CONTROL)
!       if (sig != DEBUG_TRAP)	/* run_debug_trap does this */
! 	save_pipeline (1);	/* XXX only provides one save level */
  #endif
  
***************
*** 941,945 ****
  
  #if defined (JOB_CONTROL)
!       restore_pipeline (1);
  #endif
  
--- 942,947 ----
  
  #if defined (JOB_CONTROL)
!       if (sig != DEBUG_TRAP)	/* run_debug_trap does this */
! 	restore_pipeline (1);
  #endif
  
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 1
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 2
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-003

Bug-Reported-by:	Anatol Pomozov <anatol.pomozov@gmail.com>
Bug-Reference-ID:	<CAOMFOmXy3mT2So5GQ5F-smCVArQuAeBwZ2QKzgCtMeXJoDeYOQ@mail.gmail.com>
Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-readline/2014-03/msg00010.html

Bug-Description:

When in callback mode, some readline commands can cause readline to seg
fault by passing invalid contexts to callback functions.

Patch (apply with `patch -p0'):

*** ../bash-4.3/lib/readline/readline.c	2013-10-28 14:58:06.000000000 -0400
--- lib/readline/readline.c	2014-03-10 14:15:02.000000000 -0400
***************
*** 745,749 ****
  
    RL_CHECK_SIGNALS ();
!   if (r == 0)			/* success! */
      {
        _rl_keyseq_chain_dispose ();
--- 745,750 ----
  
    RL_CHECK_SIGNALS ();
!   /* We only treat values < 0 specially to simulate recursion. */
!   if (r >= 0 || (r == -1 && (cxt->flags & KSEQ_SUBSEQ) == 0))	/* success! or failure! */
      {
        _rl_keyseq_chain_dispose ();
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 2
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 3
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-004

Bug-Reported-by:	Daan van Rossum <daan@flash.uchicago.edu>
Bug-Reference-ID:	<20140307072523.GA14250@flash.uchicago.edu>
Bug-Reference-URL:	

Bug-Description:

The `.' command in vi mode cannot undo multi-key commands beginning with
`c', `d', and `y' (command plus motion specifier).

Patch (apply with `patch -p0'):

*** ../bash-4.3/lib/readline/readline.c	2013-10-28 14:58:06.000000000 -0400
--- lib/readline/readline.c	2014-03-07 15:20:33.000000000 -0500
***************
*** 965,969 ****
    if (rl_editing_mode == vi_mode && _rl_keymap == vi_movement_keymap &&
        key != ANYOTHERKEY &&
!       rl_key_sequence_length == 1 &&	/* XXX */
        _rl_vi_textmod_command (key))
      _rl_vi_set_last (key, rl_numeric_arg, rl_arg_sign);
--- 965,969 ----
    if (rl_editing_mode == vi_mode && _rl_keymap == vi_movement_keymap &&
        key != ANYOTHERKEY &&
!       _rl_dispatching_keymap == vi_movement_keymap &&
        _rl_vi_textmod_command (key))
      _rl_vi_set_last (key, rl_numeric_arg, rl_arg_sign);
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 3
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 4
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-005

Bug-Reported-by:	David Sines <dave.gma@googlemail.com>
Bug-Reference-ID:	<CAO3BAa_CK_Rgkhdfzs+NJ4KFYdB9qW3pvXQK0xLCi6GMmDU8bw@mail.gmail.com>
Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2014-03/msg00037.html

Bug-Description:

When in Posix mode, bash did not correctly interpret the ANSI-C-style
$'...' quoting mechanism when performing pattern substitution word
expansions within double quotes.

Patch (apply with `patch -p0'):

*** ../bash-4.3/parse.y	2014-02-11 09:42:10.000000000 -0500
--- parse.y	2014-03-07 20:57:15.000000000 -0500
***************
*** 3399,3403 ****
           unescaped double-quotes or single-quotes, if any, shall occur." */
        /* This was changed in Austin Group Interp 221 */
!       if MBTEST(posixly_correct && shell_compatibility_level > 41 && dolbrace_state != DOLBRACE_QUOTE && (flags & P_DQUOTE) && (flags & P_DOLBRACE) && ch == '\'')
  	continue;
  
--- 3399,3403 ----
           unescaped double-quotes or single-quotes, if any, shall occur." */
        /* This was changed in Austin Group Interp 221 */
!       if MBTEST(posixly_correct && shell_compatibility_level > 41 && dolbrace_state != DOLBRACE_QUOTE && dolbrace_state != DOLBRACE_QUOTE2 && (flags & P_DQUOTE) && (flags & P_DOLBRACE) && ch == '\'')
  	continue;
  
*** ../bash-4.3/y.tab.c	2014-02-11 10:57:47.000000000 -0500
--- y.tab.c	2014-03-28 10:41:15.000000000 -0400
***************
*** 5711,5715 ****
           unescaped double-quotes or single-quotes, if any, shall occur." */
        /* This was changed in Austin Group Interp 221 */
!       if MBTEST(posixly_correct && shell_compatibility_level > 41 && dolbrace_state != DOLBRACE_QUOTE && (flags & P_DQUOTE) && (flags & P_DOLBRACE) && ch == '\'')
  	continue;
  
--- 5711,5715 ----
           unescaped double-quotes or single-quotes, if any, shall occur." */
        /* This was changed in Austin Group Interp 221 */
!       if MBTEST(posixly_correct && shell_compatibility_level > 41 && dolbrace_state != DOLBRACE_QUOTE && dolbrace_state != DOLBRACE_QUOTE2 && (flags & P_DQUOTE) && (flags & P_DOLBRACE) && ch == '\'')
  	continue;
  
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 4
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 5
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-006

Bug-Reported-by:	Eduardo A . Bustamante Lopez <dualbus@gmail.com>
Bug-Reference-ID:	<20140228170013.GA16015@dualbus.me>
Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2014-02/msg00091.html

Bug-Description:

A shell that started with job control active but was not interactive left
the terminal in the wrong process group when exiting, causing its parent
shell to get a stop signal when it attempted to read from the terminal.

Patch (apply with `patch -p0'):

*** ../bash-4.3/jobs.c	2014-01-10 09:05:34.000000000 -0500
--- jobs.c	2014-03-02 18:05:09.000000000 -0500
***************
*** 4375,4379 ****
  end_job_control ()
  {
!   if (interactive_shell)		/* XXX - should it be interactive? */
      {
        terminate_stopped_jobs ();
--- 4375,4379 ----
  end_job_control ()
  {
!   if (interactive_shell || job_control)		/* XXX - should it be just job_control? */
      {
        terminate_stopped_jobs ();
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 5
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 6
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-007

Bug-Reported-by:	geir.hauge@gmail.com
Bug-Reference-ID:	<20140318093650.B181C1C5B0B@gina.itea.ntnu.no>
Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2014-03/msg00095.html

Bug-Description:

Using compound assignments for associative arrays like

assoc=( [x]= [y]=bar )

left the value corresponding to the key `x' NULL.  This caused subsequent
lookups to interpret it as unset.

Patch (apply with `patch -p0'):

*** ../bash-4.3/arrayfunc.c	2013-08-02 16:19:59.000000000 -0400
--- arrayfunc.c	2014-03-18 11:08:15.000000000 -0400
***************
*** 598,601 ****
--- 598,606 ----
  	{
  	  val = expand_assignment_string_to_string (val, 0);
+ 	  if (val == 0)
+ 	    {
+ 	      val = (char *)xmalloc (1);
+ 	      val[0] = '\0';	/* like do_assignment_internal */
+ 	    }
  	  free_val = 1;
  	}
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 6
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 7
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-008

Bug-Reported-by:	Stephane Chazelas <stephane.chazelas@gmail.com>
Bug-Reference-ID:	<20140318135901.GB22158@chaz.gmail.com>
Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2014-03/msg00098.html

Bug-Description:

Some extended glob patterns incorrectly matched filenames with a leading
dot, regardless of the setting of the `dotglob' option.

Patch (apply with `patch -p0'):

*** ../bash-4.3/lib/glob/gmisc.c	2013-10-28 14:45:25.000000000 -0400
--- lib/glob/gmisc.c	2014-03-19 09:16:08.000000000 -0400
***************
*** 211,214 ****
--- 211,215 ----
      case '!':
      case '@':
+     case '?':
        return (pat[1] == LPAREN);
      default:
*** ../bash-4.3/lib/glob/glob.c	2014-01-31 21:43:51.000000000 -0500
--- lib/glob/glob.c	2014-03-20 09:01:26.000000000 -0400
***************
*** 180,202 ****
       int flags;
  {
!   char *pp, *pe, *t;
!   int n, r;
  
    pp = pat + 2;
!   pe = pp + strlen (pp) - 1;	/*(*/
!   if (*pe != ')')
!     return 0;
!   if ((t = strchr (pp, '|')) == 0)	/* easy case first */
      {
        *pe = '\0';
        r = skipname (pp, dname, flags);	/*(*/
        *pe = ')';
        return r;
      }
    while (t = glob_patscan (pp, pe, '|'))
      {
        n = t[-1];
        t[-1] = '\0';
        r = skipname (pp, dname, flags);
        t[-1] = n;
        if (r == 0)	/* if any pattern says not skip, we don't skip */
--- 180,215 ----
       int flags;
  {
!   char *pp, *pe, *t, *se;
!   int n, r, negate;
  
+   negate = *pat == '!';
    pp = pat + 2;
!   se = pp + strlen (pp) - 1;		/* end of string */
!   pe = glob_patscan (pp, se, 0);	/* end of extglob pattern (( */
!   /* we should check for invalid extglob pattern here */
!   /* if pe != se we have more of the pattern at the end of the extglob
!      pattern. Check the easy case first ( */
!   if (pe == se && *pe == ')' && (t = strchr (pp, '|')) == 0)
      {
        *pe = '\0';
+ #if defined (HANDLE_MULTIBYTE)
+       r = mbskipname (pp, dname, flags);
+ #else
        r = skipname (pp, dname, flags);	/*(*/
+ #endif
        *pe = ')';
        return r;
      }
+ 
+   /* check every subpattern */
    while (t = glob_patscan (pp, pe, '|'))
      {
        n = t[-1];
        t[-1] = '\0';
+ #if defined (HANDLE_MULTIBYTE)
+       r = mbskipname (pp, dname, flags);
+ #else
        r = skipname (pp, dname, flags);
+ #endif
        t[-1] = n;
        if (r == 0)	/* if any pattern says not skip, we don't skip */
***************
*** 205,219 ****
      }	/*(*/
  
!   if (pp == pe)		/* glob_patscan might find end of pattern */
      return r;
  
!   *pe = '\0';
! #  if defined (HANDLE_MULTIBYTE)
!   r = mbskipname (pp, dname, flags);	/*(*/
! #  else
!   r = skipname (pp, dname, flags);	/*(*/
! #  endif
!   *pe = ')';
!   return r;
  }
  #endif
--- 218,227 ----
      }	/*(*/
  
!   /* glob_patscan might find end of pattern */
!   if (pp == se)
      return r;
  
!   /* but if it doesn't then we didn't match a leading dot */
!   return 0;
  }
  #endif
***************
*** 278,289 ****
  {
  #if EXTENDED_GLOB
!   wchar_t *pp, *pe, *t, n;
!   int r;
  
    pp = pat + 2;
!   pe = pp + wcslen (pp) - 1;	/*(*/
!   if (*pe != L')')
!     return 0;
!   if ((t = wcschr (pp, L'|')) == 0)
      {
        *pe = L'\0';
--- 286,298 ----
  {
  #if EXTENDED_GLOB
!   wchar_t *pp, *pe, *t, n, *se;
!   int r, negate;
  
+   negate = *pat == L'!';
    pp = pat + 2;
!   se = pp + wcslen (pp) - 1;	/*(*/
!   pe = glob_patscan_wc (pp, se, 0);
! 
!   if (pe == se && *pe == ')' && (t = wcschr (pp, L'|')) == 0)
      {
        *pe = L'\0';
***************
*** 292,295 ****
--- 301,306 ----
        return r;
      }
+ 
+   /* check every subpattern */
    while (t = glob_patscan_wc (pp, pe, '|'))
      {
***************
*** 306,313 ****
      return r;
  
!   *pe = L'\0';
!   r = wchkname (pp, dname);	/*(*/
!   *pe = L')';
!   return r;
  #else
    return (wchkname (pat, dname));
--- 317,322 ----
      return r;
  
!   /* but if it doesn't then we didn't match a leading dot */
!   return 0;
  #else
    return (wchkname (pat, dname));
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 7
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 8
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-009

Bug-Reported-by:	Matthias Klose <doko@debian.org>
Bug-Reference-ID:	<53346FC8.6090005@debian.org>
Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2014-03/msg00171.html

Bug-Description:

There is a problem with unsigned sign extension when attempting to reallocate
the input line when it is fewer than 3 characters long and there has been a
history expansion.  The sign extension causes the shell to not reallocate the
line, which results in a segmentation fault when it writes past the end.

Patch (apply with `patch -p0'):

*** ../bash-4.3-patched/parse.y	2014-02-11 09:42:10.000000000 -0500
--- parse.y	2014-03-27 16:33:29.000000000 -0400
***************
*** 2425,2429 ****
        if (shell_input_line_terminator != EOF)
  	{
! 	  if (shell_input_line_size < SIZE_MAX && shell_input_line_len > shell_input_line_size - 3)
  	    shell_input_line = (char *)xrealloc (shell_input_line,
  					1 + (shell_input_line_size += 2));
--- 2425,2429 ----
        if (shell_input_line_terminator != EOF)
  	{
! 	  if (shell_input_line_size < SIZE_MAX-3 && (shell_input_line_len+3 > shell_input_line_size))
  	    shell_input_line = (char *)xrealloc (shell_input_line,
  					1 + (shell_input_line_size += 2));
*** ../bash-4.3-patched/y.tab.c	2014-03-28 11:17:06.000000000 -0400
--- y.tab.c	2014-04-07 11:48:31.000000000 -0400
***************
*** 4737,4741 ****
        if (shell_input_line_terminator != EOF)
  	{
! 	  if (shell_input_line_size < SIZE_MAX && shell_input_line_len > shell_input_line_size - 3)
  	    shell_input_line = (char *)xrealloc (shell_input_line,
  					1 + (shell_input_line_size += 2));
--- 4737,4741 ----
        if (shell_input_line_terminator != EOF)
  	{
! 	  if (shell_input_line_size < SIZE_MAX-3 && (shell_input_line_len+3 > shell_input_line_size))
  	    shell_input_line = (char *)xrealloc (shell_input_line,
  					1 + (shell_input_line_size += 2));
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 8
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 9
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-010

Bug-Reported-by:	Albert Shih <Albert.Shih@obspm.fr>
Bug-Reference-ID:	Wed, 5 Mar 2014 23:01:40 +0100
Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2014-03/msg00028.html

Bug-Description:

Patch (apply with `patch -p0'):

This patch changes the behavior of programmable completion to compensate
for two assumptions made by the bash-completion package.  Bash-4.3 changed
to dequote the argument to programmable completion only under certain
circumstances, to make the behavior of compgen more consistent when run
from the command line -- closer to the behavior when run by a shell function
run as part of programmable completion.  Bash-completion can pass quoted
arguments to compgen when the original word to be completed was not quoted,
expecting programmable completion to dequote the word before attempting
completion.

This patch fixes two cases:

1.  An empty string that bash-completion passes to compgen as a quoted null
    string ('').

2.  An unquoted word that bash-completion quotes using single quotes or
    backslashes before passing it to compgen.

In these cases, since readline did not detect a quote character in the original
word to be completed, bash-4.3 

*** ../bash-4.3/externs.h	2014-01-02 14:58:20.000000000 -0500
--- externs.h	2014-03-13 14:42:57.000000000 -0400
***************
*** 325,328 ****
--- 325,329 ----
  extern char *sh_backslash_quote_for_double_quotes __P((char *));
  extern int sh_contains_shell_metas __P((char *));
+ extern int sh_contains_quotes __P((char *));
  
  /* declarations for functions defined in lib/sh/spell.c */
*** ../bash-4.3/lib/sh/shquote.c	2013-03-31 21:53:32.000000000 -0400
--- lib/sh/shquote.c	2014-03-13 14:42:57.000000000 -0400
***************
*** 312,313 ****
--- 312,327 ----
    return (0);
  }
+ 
+ int
+ sh_contains_quotes (string)
+      char *string;
+ {
+   char *s;
+ 
+   for (s = string; s && *s; s++)
+     {
+       if (*s == '\'' || *s == '"' || *s == '\\')
+ 	return 1;
+     }
+   return 0;
+ }
*** ../bash-4.3/pcomplete.c	2013-08-26 15:23:45.000000000 -0400
--- pcomplete.c	2014-03-25 17:23:23.000000000 -0400
***************
*** 184,187 ****
--- 184,188 ----
  COMPSPEC *pcomp_curcs;
  const char *pcomp_curcmd;
+ const char *pcomp_curtxt;
  
  #ifdef DEBUG
***************
*** 754,757 ****
--- 755,784 ----
  	  dfn = (*rl_filename_dequoting_function) ((char *)text, rl_completion_quote_character);
  	}
+       /* Intended to solve a mismatched assumption by bash-completion.  If
+ 	 the text to be completed is empty, but bash-completion turns it into
+ 	 a quoted string ('') assuming that this code will dequote it before
+ 	 calling readline, do the dequoting. */
+       else if (iscompgen && iscompleting &&
+ 	       pcomp_curtxt && *pcomp_curtxt == 0 &&
+ 	       text && (*text == '\'' || *text == '"') && text[1] == text[0] && text[2] == 0 && 
+ 	       rl_filename_dequoting_function)
+ 	dfn = (*rl_filename_dequoting_function) ((char *)text, rl_completion_quote_character);
+       /* Another mismatched assumption by bash-completion.  If compgen is being
+       	 run as part of bash-completion, and the argument to compgen is not
+       	 the same as the word originally passed to the programmable completion
+       	 code, dequote the argument if it has quote characters.  It's an
+       	 attempt to detect when bash-completion is quoting its filename
+       	 argument before calling compgen. */
+       /* We could check whether gen_shell_function_matches is in the call
+ 	 stack by checking whether the gen-shell-function-matches tag is in
+ 	 the unwind-protect stack, but there's no function to do that yet.
+ 	 We could simply check whether we're executing in a function by
+ 	 checking variable_context, and may end up doing that. */
+       else if (iscompgen && iscompleting && rl_filename_dequoting_function &&
+ 	       pcomp_curtxt && text &&
+ 	       STREQ (pcomp_curtxt, text) == 0 &&
+ 	       variable_context &&
+ 	       sh_contains_quotes (text))	/* guess */
+ 	dfn = (*rl_filename_dequoting_function) ((char *)text, rl_completion_quote_character);
        else
  	dfn = savestring (text);
***************
*** 1523,1527 ****
  {
    COMPSPEC *cs, *oldcs;
!   const char *oldcmd;
    STRINGLIST *ret;
  
--- 1550,1554 ----
  {
    COMPSPEC *cs, *oldcs;
!   const char *oldcmd, *oldtxt;
    STRINGLIST *ret;
  
***************
*** 1546,1552 ****
--- 1573,1581 ----
    oldcs = pcomp_curcs;
    oldcmd = pcomp_curcmd;
+   oldtxt = pcomp_curtxt;
  
    pcomp_curcs = cs;
    pcomp_curcmd = cmd;
+   pcomp_curtxt = word;
  
    ret = gen_compspec_completions (cs, cmd, word, start, end, foundp);
***************
*** 1554,1557 ****
--- 1583,1587 ----
    pcomp_curcs = oldcs;
    pcomp_curcmd = oldcmd;
+   pcomp_curtxt = oldtxt;
  
    /* We need to conditionally handle setting *retryp here */
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 9
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 10
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-011

Bug-Reported-by:	Egmont Koblinger <egmont@gmail.com>
Bug-Reference-ID:	<CAGWcZk+bU5Jo1M+tutGvL-250UBE9DXjpeJVofYJSFcqFEVfMg@mail.gmail.com>
Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2014-03/msg00153.html

Bug-Description:

The signal handling changes to bash and readline (to avoid running any code
in a signal handler context) cause the cursor to be placed on the wrong
line of a multi-line command after a ^C interrupts editing.

Patch (apply with `patch -p0'):

*** ../bash-4.3-patched/lib/readline/display.c	2013-12-27 13:10:56.000000000 -0500
--- lib/readline/display.c	2014-03-27 11:52:45.000000000 -0400
***************
*** 2678,2682 ****
    if (_rl_echoing_p)
      {
!       _rl_move_vert (_rl_vis_botlin);
        _rl_vis_botlin = 0;
        fflush (rl_outstream);
--- 2678,2683 ----
    if (_rl_echoing_p)
      {
!       if (_rl_vis_botlin > 0)	/* minor optimization plus bug fix */
! 	_rl_move_vert (_rl_vis_botlin);
        _rl_vis_botlin = 0;
        fflush (rl_outstream);
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 10
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 11
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-012

Bug-Reported-by:	Eduardo A. Bustamante López<dualbus@gmail.com>
Bug-Reference-ID:	<5346B54C.4070205@case.edu>
Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2014-04/msg00051.html

Bug-Description:

When a SIGCHLD trap runs a command containing a shell builtin while
a script is running `wait' to wait for all running children to complete,
the SIGCHLD trap will not be run once for each child that terminates.

Patch (apply with `patch -p0'):

*** ../bash-4.3-patched/jobs.c	2014-03-28 10:54:19.000000000 -0400
--- jobs.c	2014-04-15 08:47:03.000000000 -0400
***************
*** 3598,3601 ****
--- 3598,3602 ----
    unwind_protect_pointer (the_pipeline);
    unwind_protect_pointer (subst_assign_varlist);
+   unwind_protect_pointer (this_shell_builtin);
  
    /* We have to add the commands this way because they will be run
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 11
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 12
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-013

Bug-Reported-by:	<Trond.Endrestol@ximalas.info>
Bug-Reference-ID:	<alpine.BSF.2.03.1404192114310.1973@enterprise.ximalas.info>
Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2014-04/msg00069.html

Bug-Description:

Using reverse-i-search when horizontal scrolling is enabled does not redisplay
the entire line containing the successful search results.

Patch (apply with `patch -p0'):
*** ../bash-4.3-patched/lib/readline/display.c	2014-04-08 18:19:36.000000000 -0400
--- lib/readline/display.c	2014-04-20 18:32:52.000000000 -0400
***************
*** 1638,1642 ****
       the spot of first difference is before the end of the invisible chars,
       lendiff needs to be adjusted. */
!   if (current_line == 0 && !_rl_horizontal_scroll_mode &&
        current_invis_chars != visible_wrap_offset)
      {
--- 1638,1642 ----
       the spot of first difference is before the end of the invisible chars,
       lendiff needs to be adjusted. */
!   if (current_line == 0 && /* !_rl_horizontal_scroll_mode && */
        current_invis_chars != visible_wrap_offset)
      {
***************
*** 1826,1831 ****
  		_rl_last_c_pos += bytes_to_insert;
  
  	      if (_rl_horizontal_scroll_mode && ((oe-old) > (ne-new)))
! 		goto clear_rest_of_line;
  	    }
  	}
--- 1826,1836 ----
  		_rl_last_c_pos += bytes_to_insert;
  
+ 	      /* XXX - we only want to do this if we are at the end of the line
+ 		 so we move there with _rl_move_cursor_relative */
  	      if (_rl_horizontal_scroll_mode && ((oe-old) > (ne-new)))
! 		{
! 		  _rl_move_cursor_relative (ne-new, new);
! 		  goto clear_rest_of_line;
! 		}
  	    }
  	}
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 12
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 13
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-014

Bug-Reported-by:	Greg Wooledge <wooledg@eeg.ccf.org>
Bug-Reference-ID:	<20140418202123.GB7660@eeg.ccf.org>
Bug-Reference-URL:	http://lists.gnu.org/archive/html/help-bash/2014-04/msg00004.html

Bug-Description:

Under certain circumstances, $@ is expanded incorrectly in contexts where
word splitting is not performed.

Patch (apply with `patch -p0'):
*** ../bash-4.3-patched/subst.c	2014-01-23 16:26:37.000000000 -0500
--- subst.c	2014-04-19 15:41:26.000000000 -0400
***************
*** 3249,3254 ****
--- 3249,3256 ----
      return ((char *)NULL);
  
+   expand_no_split_dollar_star = 1;
    w->flags |= W_NOSPLIT2;
    l = call_expand_word_internal (w, 0, 0, (int *)0, (int *)0);
+   expand_no_split_dollar_star = 0;
    if (l)
      {
***************
*** 7848,7851 ****
--- 7850,7857 ----
  	 according to POSIX.2, this expands to a list of the positional
  	 parameters no matter what IFS is set to. */
+       /* XXX - what to do when in a context where word splitting is not
+ 	 performed? Even when IFS is not the default, posix seems to imply
+ 	 that we behave like unquoted $* ?  Maybe we should use PF_NOSPLIT2
+ 	 here. */
        temp = string_list_dollar_at (list, (pflags & PF_ASSIGNRHS) ? (quoted|Q_DOUBLE_QUOTES) : quoted);
  
***************
*** 8817,8820 ****
--- 8823,8827 ----
      {
        char *ifs_chars;
+       char *tstring;
  
        ifs_chars = (quoted_dollar_at || has_dollar_at) ? ifs_value : (char *)NULL;
***************
*** 8831,8834 ****
--- 8838,8865 ----
        if (split_on_spaces)
  	list = list_string (istring, " ", 1);	/* XXX quoted == 1? */
+       /* If we have $@ (has_dollar_at != 0) and we are in a context where we
+ 	 don't want to split the result (W_NOSPLIT2), and we are not quoted,
+ 	 we have already separated the arguments with the first character of
+ 	 $IFS.  In this case, we want to return a list with a single word
+ 	 with the separator possibly replaced with a space (it's what other
+ 	 shells seem to do).
+ 	 quoted_dollar_at is internal to this function and is set if we are
+ 	 passed an argument that is unquoted (quoted == 0) but we encounter a
+ 	 double-quoted $@ while expanding it. */
+       else if (has_dollar_at && quoted_dollar_at == 0 && ifs_chars && quoted == 0 && (word->flags & W_NOSPLIT2))
+ 	{
+ 	  /* Only split and rejoin if we have to */
+ 	  if (*ifs_chars && *ifs_chars != ' ')
+ 	    {
+ 	      list = list_string (istring, *ifs_chars ? ifs_chars : " ", 1);
+ 	      tstring = string_list (list);
+ 	    }
+ 	  else
+ 	    tstring = istring;
+ 	  tword = make_bare_word (tstring);
+ 	  if (tstring != istring)
+ 	    free (tstring);
+ 	  goto set_word_flags;
+ 	}
        else if (has_dollar_at && ifs_chars)
  	list = list_string (istring, *ifs_chars ? ifs_chars : " ", 1);
***************
*** 8836,8839 ****
--- 8867,8871 ----
  	{
  	  tword = make_bare_word (istring);
+ set_word_flags:
  	  if ((quoted & (Q_DOUBLE_QUOTES|Q_HERE_DOCUMENT)) || (quoted_state == WHOLLY_QUOTED))
  	    tword->flags |= W_QUOTED;
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 13
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 14
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-015

Bug-Reported-by:	Clark Wang <dearvoid@gmail.com>
Bug-Reference-ID:	<CADv8-og2TOSoabXeNVXVGaXN3tEMHnYVq1rwOLe5meaRPSGRig@mail.gmail.com>
Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2014-04/msg00095.html

Bug-Description:

When completing directory names, the directory name is dequoted twice.
This causes problems for directories with single and double quotes in
their names.

Patch (apply with `patch -p0'):
*** ../bash-4.3-patched/bashline.c	2014-02-09 19:56:58.000000000 -0500
--- bashline.c	2014-04-25 14:57:52.000000000 -0400
***************
*** 4168,4174 ****
  
    qc = rl_dispatching ? rl_completion_quote_character : 0;  
!   dfn = bash_dequote_filename ((char *)text, qc);
    m1 = rl_completion_matches (dfn, rl_filename_completion_function);
!   free (dfn);
  
    if (m1 == 0 || m1[0] == 0)
--- 4209,4222 ----
  
    qc = rl_dispatching ? rl_completion_quote_character : 0;  
!   /* If rl_completion_found_quote != 0, rl_completion_matches will call the
!      filename dequoting function, causing the directory name to be dequoted
!      twice. */
!   if (rl_dispatching && rl_completion_found_quote == 0)
!     dfn = bash_dequote_filename ((char *)text, qc);
!   else
!     dfn = (char *)text;
    m1 = rl_completion_matches (dfn, rl_filename_completion_function);
!   if (dfn != text)
!     free (dfn);
  
    if (m1 == 0 || m1[0] == 0)
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 14
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 15
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-016

Bug-Reported-by:	Pierre Gaston <pierre.gaston@gmail.com>
Bug-Reference-ID:	<CAPSX3sTCD61k1VQLJ5r-LWzEt+e7Xc-fxXmwn2u8EA5gJJej8Q@mail.gmail.com>
Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2014-04/msg00100.html

Bug-Description:

An extended glob pattern containing a slash (`/') causes the globbing code
to misinterpret it as a directory separator.

Patch (apply with `patch -p0'):
*** ../bash-4.3-patched/lib/glob/glob.c	2014-03-28 10:54:23.000000000 -0400
--- lib/glob/glob.c	2014-05-02 10:24:28.000000000 -0400
***************
*** 124,127 ****
--- 124,129 ----
  extern wchar_t *glob_patscan_wc __P((wchar_t *, wchar_t *, int));
  
+ extern char *glob_dirscan __P((char *, int));
+ 
  /* Compile `glob_loop.c' for single-byte characters. */
  #define CHAR	unsigned char
***************
*** 188,191 ****
--- 190,196 ----
    pe = glob_patscan (pp, se, 0);	/* end of extglob pattern (( */
    /* we should check for invalid extglob pattern here */
+   if (pe == 0)
+     return 0;
+ 
    /* if pe != se we have more of the pattern at the end of the extglob
       pattern. Check the easy case first ( */
***************
*** 1016,1020 ****
    char **result;
    unsigned int result_size;
!   char *directory_name, *filename, *dname;
    unsigned int directory_len;
    int free_dirname;			/* flag */
--- 1021,1025 ----
    char **result;
    unsigned int result_size;
!   char *directory_name, *filename, *dname, *fn;
    unsigned int directory_len;
    int free_dirname;			/* flag */
***************
*** 1032,1035 ****
--- 1037,1052 ----
    /* Find the filename.  */
    filename = strrchr (pathname, '/');
+ #if defined (EXTENDED_GLOB)
+   if (filename && extended_glob)
+     {
+       fn = glob_dirscan (pathname, '/');
+ #if DEBUG_MATCHING
+       if (fn != filename)
+ 	fprintf (stderr, "glob_filename: glob_dirscan: fn (%s) != filename (%s)\n", fn ? fn : "(null)", filename);
+ #endif
+       filename = fn;
+     }
+ #endif
+ 
    if (filename == NULL)
      {
*** ../bash-4.3-patched/lib/glob/gmisc.c	2014-03-28 10:54:23.000000000 -0400
--- lib/glob/gmisc.c	2014-05-02 09:35:57.000000000 -0400
***************
*** 43,46 ****
--- 43,48 ----
  #define WRPAREN         L')'
  
+ extern char *glob_patscan __P((char *, char *, int));
+ 
  /* Return 1 of the first character of WSTRING could match the first
     character of pattern WPAT.  Wide character version. */
***************
*** 376,377 ****
--- 378,410 ----
    return matlen;
  }
+ 
+ /* Skip characters in PAT and return the final occurrence of DIRSEP.  This
+    is only called when extended_glob is set, so we have to skip over extglob
+    patterns x(...) */
+ char *
+ glob_dirscan (pat, dirsep)
+      char *pat;
+      int dirsep;
+ {
+   char *p, *d, *pe, *se;
+ 
+   d = pe = se = 0;
+   for (p = pat; p && *p; p++)
+     {
+       if (extglob_pattern_p (p))
+ 	{
+ 	  if (se == 0)
+ 	    se = p + strlen (p) - 1;
+ 	  pe = glob_patscan (p + 2, se, 0);
+ 	  if (pe == 0)
+ 	    continue;
+ 	  else if (*pe == 0)
+ 	    break;
+ 	  p = pe - 1;	/* will do increment above */
+ 	  continue;
+ 	}
+       if (*p ==  dirsep)
+ 	d = p;
+     }
+   return d;
+ }

*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 15
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 16
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-017

Bug-Reported-by:	Dan Douglas <ormaaj@gmail.com>
Bug-Reference-ID:	<7781746.RhfoTROLxF@smorgbox>
Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2014-05/msg00026.html

Bug-Description:

The code that creates local variables should not clear the `invisible'
attribute when returning an existing local variable.  Let the code that
actually assigns a value clear it.

Patch (apply with `patch -p0'):
*** ../bash-4.3-patched/variables.c	2014-02-14 11:55:12.000000000 -0500
--- variables.c	2014-05-07 10:53:57.000000000 -0400
***************
*** 2198,2205 ****
    old_var = find_variable (name);
    if (old_var && local_p (old_var) && old_var->context == variable_context)
!     {
!       VUNSETATTR (old_var, att_invisible);	/* XXX */
!       return (old_var);
!     }
  
    was_tmpvar = old_var && tempvar_p (old_var);
--- 2260,2264 ----
    old_var = find_variable (name);
    if (old_var && local_p (old_var) && old_var->context == variable_context)
!     return (old_var);
  
    was_tmpvar = old_var && tempvar_p (old_var);

*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 16
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 17
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-018

Bug-Reported-by:	Geir Hauge <geir.hauge@gmail.com>
Bug-Reference-ID:	<CAO-BiTLOvfPXDypg61jcBausADrxUKJejakV2WTWP26cW0=rgA@mail.gmail.com>
Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2014-05/msg00040.html

Bug-Description:

When assigning an array variable using the compound assignment syntax,
but using `declare' with the rhs of the compound assignment quoted, the
shell did not mark the variable as visible after successfully performing
the assignment.

Patch (apply with `patch -p0'):
*** ../bash-4.3-patched/arrayfunc.c	2014-03-28 10:54:21.000000000 -0400
--- arrayfunc.c	2014-05-12 11:19:00.000000000 -0400
***************
*** 180,183 ****
--- 180,184 ----
    FREE (newval);
  
+   VUNSETATTR (entry, att_invisible);	/* no longer invisible */
    return (entry);
  }

*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 17
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 18
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-019

Bug-Reported-by:	John Lenton
Bug-Reference-ID:
Bug-Reference-URL:	https://bugs.launchpad.net/ubuntu/+source/bash/+bug/1317476

Bug-Description:

The -t timeout option to `read' does not work when the -e option is used.

Patch (apply with `patch -p0'):

*** ../bash-4.3-patched/lib/readline/input.c	2014-01-10 15:07:08.000000000 -0500
--- lib/readline/input.c	2014-05-22 18:40:59.000000000 -0400
***************
*** 535,540 ****
--- 538,551 ----
        else if (_rl_caught_signal == SIGHUP || _rl_caught_signal == SIGTERM)
  	return (RL_ISSTATE (RL_STATE_READCMD) ? READERR : EOF);
+       /* keyboard-generated signals of interest */
        else if (_rl_caught_signal == SIGINT || _rl_caught_signal == SIGQUIT)
          RL_CHECK_SIGNALS ();
+       /* non-keyboard-generated signals of interest */
+       else if (_rl_caught_signal == SIGALRM
+ #if defined (SIGVTALRM)
+ 		|| _rl_caught_signal == SIGVTALRM
+ #endif
+ 	      )
+         RL_CHECK_SIGNALS ();
  
        if (rl_signal_event_hook)
*** ../bash-4.3-patched/builtins/read.def	2013-09-02 11:54:00.000000000 -0400
--- builtins/read.def	2014-05-08 11:43:35.000000000 -0400
***************
*** 443,447 ****
  #if defined (READLINE)
        if (edit)
! 	add_unwind_protect (reset_attempted_completion_function, (char *)NULL);
  #endif
        falarm (tmsec, tmusec);
--- 443,450 ----
  #if defined (READLINE)
        if (edit)
! 	{
! 	  add_unwind_protect (reset_attempted_completion_function, (char *)NULL);
! 	  add_unwind_protect (bashline_reset_event_hook, (char *)NULL);
! 	}
  #endif
        falarm (tmsec, tmusec);
***************
*** 1022,1025 ****
--- 1025,1029 ----
    old_attempted_completion_function = rl_attempted_completion_function;
    rl_attempted_completion_function = (rl_completion_func_t *)NULL;
+   bashline_set_event_hook ();
    if (itext)
      {
***************
*** 1033,1036 ****
--- 1037,1041 ----
    rl_attempted_completion_function = old_attempted_completion_function;
    old_attempted_completion_function = (rl_completion_func_t *)NULL;
+   bashline_reset_event_hook ();
  
    if (ret == 0)
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 18
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 19
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-020

Bug-Reported-by:	Jared Yanovich <slovichon@gmail.com>
Bug-Reference-ID:	<20140417073654.GB26875@nightderanger.psc.edu>
Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2014-04/msg00065.html

Bug-Description:

When PS2 contains a command substitution, here-documents entered in an
interactive shell can sometimes cause a segmentation fault.

Patch (apply with `patch -p0'):

*** ../bash-4.3-patched/shell.h	2012-12-25 21:11:01.000000000 -0500
--- shell.h	2014-06-03 09:24:28.000000000 -0400
***************
*** 169,173 ****
    int expand_aliases;
    int echo_input_at_read;
!   
  } sh_parser_state_t;
  
--- 169,174 ----
    int expand_aliases;
    int echo_input_at_read;
!   int need_here_doc;
! 
  } sh_parser_state_t;
  
*** ../bash-4.3-patched/parse.y	2014-05-14 09:16:40.000000000 -0400
--- parse.y	2014-04-30 09:27:59.000000000 -0400
***************
*** 2643,2647 ****
  
    r = 0;
!   while (need_here_doc)
      {
        parser_state |= PST_HEREDOC;
--- 2643,2647 ----
  
    r = 0;
!   while (need_here_doc > 0)
      {
        parser_state |= PST_HEREDOC;
***************
*** 6076,6079 ****
--- 6076,6080 ----
    ps->expand_aliases = expand_aliases;
    ps->echo_input_at_read = echo_input_at_read;
+   ps->need_here_doc = need_here_doc;
  
    ps->token = token;
***************
*** 6124,6127 ****
--- 6125,6129 ----
    expand_aliases = ps->expand_aliases;
    echo_input_at_read = ps->echo_input_at_read;
+   need_here_doc = ps->need_here_doc;
  
    FREE (token);
*** ../bash-4.3-patched/y.tab.c	2014-04-07 11:56:12.000000000 -0400
--- y.tab.c	2014-07-30 09:55:57.000000000 -0400
***************
*** 4955,4959 ****
  
    r = 0;
!   while (need_here_doc)
      {
        parser_state |= PST_HEREDOC;
--- 5151,5155 ----
  
    r = 0;
!   while (need_here_doc > 0)
      {
        parser_state |= PST_HEREDOC;
***************
*** 8388,8391 ****
--- 8584,8588 ----
    ps->expand_aliases = expand_aliases;
    ps->echo_input_at_read = echo_input_at_read;
+   ps->need_here_doc = need_here_doc;
  
    ps->token = token;
***************
*** 8436,8439 ****
--- 8633,8637 ----
    expand_aliases = ps->expand_aliases;
    echo_input_at_read = ps->echo_input_at_read;
+   need_here_doc = ps->need_here_doc;
  
    FREE (token);
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 19
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 20
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-021

Bug-Reported-by:	Jared Yanovich <slovichon@gmail.com>
Bug-Reference-ID:	<20140625225019.GJ17044@nightderanger.psc.edu>
Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2014-06/msg00070.html

Bug-Description:

When the readline `revert-all-at-newline' option is set, pressing newline
when the current line is one retrieved from history results in a double free
and a segmentation fault.

Patch (apply with `patch -p0'):

*** ../bash-4.3-patched/lib/readline/misc.c	2012-09-01 18:03:11.000000000 -0400
--- lib/readline/misc.c	2014-06-30 13:41:19.000000000 -0400
***************
*** 462,465 ****
--- 462,466 ----
  	  /* Set up rl_line_buffer and other variables from history entry */
  	  rl_replace_from_history (entry, 0);	/* entry->line is now current */
+ 	  entry->data = 0;			/* entry->data is now current undo list */
  	  /* Undo all changes to this history entry */
  	  while (rl_undo_list)
***************
*** 469,473 ****
  	  FREE (entry->line);
  	  entry->line = savestring (rl_line_buffer);
- 	  entry->data = 0;
  	}
        entry = previous_history ();
--- 470,473 ----

*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 20
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 21
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-022

Bug-Reported-by:	scorp.dev.null@gmail.com
Bug-Reference-ID:	<E1WxXw8-0007iE-Bi@pcm14>
Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2014-06/msg00061.html

Bug-Description:

Using nested pipelines within loops with the `lastpipe' option set can result
in a segmentation fault.

Patch (apply with `patch -p0'):

*** ../bash-4.3-patched/execute_cmd.c	2014-01-31 10:54:52.000000000 -0500
--- execute_cmd.c	2014-06-19 08:05:49.000000000 -0400
***************
*** 2410,2414 ****
        lstdin = wait_for (lastpid);
  #if defined (JOB_CONTROL)
!       exec_result = job_exit_status (lastpipe_jid);
  #endif
        unfreeze_jobs_list ();
--- 2425,2438 ----
        lstdin = wait_for (lastpid);
  #if defined (JOB_CONTROL)
!       /* If wait_for removes the job from the jobs table, use result of last
! 	 command as pipeline's exit status as usual.  The jobs list can get
! 	 frozen and unfrozen at inconvenient times if there are multiple pipelines
! 	 running simultaneously. */
!       if (INVALID_JOB (lastpipe_jid) == 0)
! 	exec_result = job_exit_status (lastpipe_jid);
!       else if (pipefail_opt)
! 	exec_result = exec_result | lstdin;	/* XXX */
!       /* otherwise we use exec_result */
!         
  #endif
        unfreeze_jobs_list ();
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 21
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 22
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-023

Bug-Reported-by:	Tim Friske <me@timfriske.com>
Bug-Reference-ID:	<CAM1RzOcOR9zzC2i+aeES6LtbHNHoOV+0pZEYPrqxv_QAii-RXA@mail.gmail.com>
Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2014-06/msg00056.html

Bug-Description:

Bash does not correctly parse process substitution constructs that contain
unbalanced parentheses as part of the contained command.

Patch (apply with `patch -p0'):

*** ../bash-4.3-patched/subst.h	2014-01-11 21:02:27.000000000 -0500
--- subst.h	2014-07-20 17:25:01.000000000 -0400
***************
*** 83,87 ****
     Start extracting at (SINDEX) as if we had just seen "<(".
     Make (SINDEX) get the position just after the matching ")". */
! extern char *extract_process_subst __P((char *, char *, int *));
  #endif /* PROCESS_SUBSTITUTION */
  
--- 83,87 ----
     Start extracting at (SINDEX) as if we had just seen "<(".
     Make (SINDEX) get the position just after the matching ")". */
! extern char *extract_process_subst __P((char *, char *, int *, int));
  #endif /* PROCESS_SUBSTITUTION */
  
*** ../bash-4.3-patched/subst.c	2014-05-15 08:26:45.000000000 -0400
--- subst.c	2014-07-20 17:26:44.000000000 -0400
***************
*** 1193,1202 ****
     Make (SINDEX) get the position of the matching ")". */ /*))*/
  char *
! extract_process_subst (string, starter, sindex)
       char *string;
       char *starter;
       int *sindex;
  {
    return (extract_delimited_string (string, sindex, starter, "(", ")", SX_COMMAND));
  }
  #endif /* PROCESS_SUBSTITUTION */
--- 1193,1208 ----
     Make (SINDEX) get the position of the matching ")". */ /*))*/
  char *
! extract_process_subst (string, starter, sindex, xflags)
       char *string;
       char *starter;
       int *sindex;
+      int xflags;
  {
+ #if 0
    return (extract_delimited_string (string, sindex, starter, "(", ")", SX_COMMAND));
+ #else
+   xflags |= (no_longjmp_on_fatal_error ? SX_NOLONGJMP : 0);
+   return (xparse_dolparen (string, string+*sindex, sindex, xflags));
+ #endif
  }
  #endif /* PROCESS_SUBSTITUTION */
***************
*** 1786,1790 ****
  	  if (string[si] == '\0')
  	    CQ_RETURN(si);
! 	  temp = extract_process_subst (string, (c == '<') ? "<(" : ">(", &si);
  	  free (temp);		/* no SX_ALLOC here */
  	  i = si;
--- 1792,1796 ----
  	  if (string[si] == '\0')
  	    CQ_RETURN(si);
! 	  temp = extract_process_subst (string, (c == '<') ? "<(" : ">(", &si, 0);
  	  free (temp);		/* no SX_ALLOC here */
  	  i = si;
***************
*** 8250,8254 ****
  	      t_index = sindex + 1; /* skip past both '<' and LPAREN */
  
! 	    temp1 = extract_process_subst (string, (c == '<') ? "<(" : ">(", &t_index); /*))*/
  	    sindex = t_index;
  
--- 8256,8260 ----
  	      t_index = sindex + 1; /* skip past both '<' and LPAREN */
  
! 	    temp1 = extract_process_subst (string, (c == '<') ? "<(" : ">(", &t_index, 0); /*))*/
  	    sindex = t_index;
  
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 22
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 23
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-024

Bug-Reported-by:	Corentin Peuvrel <cpeuvrel@pom-monitoring.com>
Bug-Reference-ID:	<53CE9E5D.6050203@pom-monitoring.com>
Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2014-07/msg00021.html

Bug-Description:

Indirect variable references do not work correctly if the reference
variable expands to an array reference using a subscript other than 0
(e.g., foo='bar[1]' ; echo ${!foo}).

Patch (apply with `patch -p0'):

*** ../bash-4.3-patched/subst.c	2014-06-03 09:32:44.000000000 -0400
--- subst.c	2014-07-23 09:58:19.000000000 -0400
***************
*** 7375,7379 ****
  
    if (want_indir)
!     tdesc = parameter_brace_expand_indir (name + 1, var_is_special, quoted, quoted_dollar_atp, contains_dollar_at);
    else
      tdesc = parameter_brace_expand_word (name, var_is_special, quoted, PF_IGNUNBOUND|(pflags&(PF_NOSPLIT2|PF_ASSIGNRHS)), &ind);
--- 7445,7455 ----
  
    if (want_indir)
!     {
!       tdesc = parameter_brace_expand_indir (name + 1, var_is_special, quoted, quoted_dollar_atp, contains_dollar_at);
!       /* Turn off the W_ARRAYIND flag because there is no way for this function
! 	 to return the index we're supposed to be using. */
!       if (tdesc && tdesc->flags)
! 	tdesc->flags &= ~W_ARRAYIND;
!     }
    else
      tdesc = parameter_brace_expand_word (name, var_is_special, quoted, PF_IGNUNBOUND|(pflags&(PF_NOSPLIT2|PF_ASSIGNRHS)), &ind);
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 23
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 24
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-025

Bug-Reported-by:	Stephane Chazelas <stephane.chazelas@gmail.com>
Bug-Reference-ID:
Bug-Reference-URL:

Bug-Description:

Under certain circumstances, bash will execute user code while processing the
environment for exported function definitions.

Patch (apply with `patch -p0'):

*** ../bash-4.3-patched/builtins/common.h	2013-07-08 16:54:47.000000000 -0400
--- builtins/common.h	2014-09-12 14:25:47.000000000 -0400
***************
*** 34,37 ****
--- 49,54 ----
  #define SEVAL_PARSEONLY	0x020
  #define SEVAL_NOLONGJMP 0x040
+ #define SEVAL_FUNCDEF	0x080		/* only allow function definitions */
+ #define SEVAL_ONECMD	0x100		/* only allow a single command */
  
  /* Flags for describe_command, shared between type.def and command.def */
*** ../bash-4.3-patched/builtins/evalstring.c	2014-02-11 09:42:10.000000000 -0500
--- builtins/evalstring.c	2014-09-14 14:15:13.000000000 -0400
***************
*** 309,312 ****
--- 313,324 ----
  	      struct fd_bitmap *bitmap;
  
+ 	      if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def)
+ 		{
+ 		  internal_warning ("%s: ignoring function definition attempt", from_file);
+ 		  should_jump_to_top_level = 0;
+ 		  last_result = last_command_exit_value = EX_BADUSAGE;
+ 		  break;
+ 		}
+ 
  	      bitmap = new_fd_bitmap (FD_BITMAP_SIZE);
  	      begin_unwind_frame ("pe_dispose");
***************
*** 369,372 ****
--- 381,387 ----
  	      dispose_fd_bitmap (bitmap);
  	      discard_unwind_frame ("pe_dispose");
+ 
+ 	      if (flags & SEVAL_ONECMD)
+ 		break;
  	    }
  	}
*** ../bash-4.3-patched/variables.c	2014-05-15 08:26:50.000000000 -0400
--- variables.c	2014-09-14 14:23:35.000000000 -0400
***************
*** 359,369 ****
  	  strcpy (temp_string + char_index + 1, string);
  
! 	  if (posixly_correct == 0 || legal_identifier (name))
! 	    parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST);
! 
! 	  /* Ancient backwards compatibility.  Old versions of bash exported
! 	     functions like name()=() {...} */
! 	  if (name[char_index - 1] == ')' && name[char_index - 2] == '(')
! 	    name[char_index - 2] = '\0';
  
  	  if (temp_var = find_function (name))
--- 364,372 ----
  	  strcpy (temp_string + char_index + 1, string);
  
! 	  /* Don't import function names that are invalid identifiers from the
! 	     environment, though we still allow them to be defined as shell
! 	     variables. */
! 	  if (legal_identifier (name))
! 	    parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD);
  
  	  if (temp_var = find_function (name))
***************
*** 382,389 ****
  	      report_error (_("error importing function definition for `%s'"), name);
  	    }
- 
- 	  /* ( */
- 	  if (name[char_index - 1] == ')' && name[char_index - 2] == '\0')
- 	    name[char_index - 2] = '(';		/* ) */
  	}
  #if defined (ARRAY_VARS)
--- 385,388 ----
*** ../bash-4.3-patched/subst.c	2014-08-11 11:16:35.000000000 -0400
--- subst.c	2014-09-12 15:31:04.000000000 -0400
***************
*** 8048,8052 ****
  	  goto return0;
  	}
!       else if (var = find_variable_last_nameref (temp1))
  	{
  	  temp = nameref_cell (var);
--- 8118,8124 ----
  	  goto return0;
  	}
!       else if (var && (invisible_p (var) || var_isset (var) == 0))
! 	temp = (char *)NULL;
!       else if ((var = find_variable_last_nameref (temp1)) && var_isset (var) && invisible_p (var) == 0)
  	{
  	  temp = nameref_cell (var);
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 24
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 25
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-026

Bug-Reported-by:	Tavis Ormandy <taviso@cmpxchg8b.com>
Bug-Reference-ID:
Bug-Reference-URL:	http://twitter.com/taviso/statuses/514887394294652929

Bug-Description:

Under certain circumstances, bash can incorrectly save a lookahead character and
return it on a subsequent call, even when reading a new line.

Patch (apply with `patch -p0'):

*** ../bash-4.3.25/parse.y	2014-07-30 10:14:31.000000000 -0400
--- parse.y	2014-09-25 20:20:21.000000000 -0400
***************
*** 2954,2957 ****
--- 2954,2959 ----
    word_desc_to_read = (WORD_DESC *)NULL;
  
+   eol_ungetc_lookahead = 0;
+ 
    current_token = '\n';		/* XXX */
    last_read_token = '\n';
*** ../bash-4.3.25/y.tab.c	2014-07-30 10:14:32.000000000 -0400
--- y.tab.c	2014-09-25 20:21:48.000000000 -0400
***************
*** 5266,5269 ****
--- 5266,5271 ----
    word_desc_to_read = (WORD_DESC *)NULL;
  
+   eol_ungetc_lookahead = 0;
+ 
    current_token = '\n';		/* XXX */
    last_read_token = '\n';
***************
*** 8540,8542 ****
  }
  #endif /* HANDLE_MULTIBYTE */
- 
--- 8542,8543 ----
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 25
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 26
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-027

Bug-Reported-by:	Florian Weimer <fweimer@redhat.com>
Bug-Reference-ID:
Bug-Reference-URL:

Bug-Description:

This patch changes the encoding bash uses for exported functions to avoid
clashes with shell variables and to avoid depending only on an environment
variable's contents to determine whether or not to interpret it as a shell
function.

Patch (apply with `patch -p0'):

*** ../bash-4.3.26/variables.c	2014-09-25 23:02:18.000000000 -0400
--- variables.c	2014-09-27 20:52:04.000000000 -0400
***************
*** 84,87 ****
--- 84,92 ----
  #define ifsname(s)	((s)[0] == 'I' && (s)[1] == 'F' && (s)[2] == 'S' && (s)[3] == '\0')
  
+ #define BASHFUNC_PREFIX		"BASH_FUNC_"
+ #define BASHFUNC_PREFLEN	10	/* == strlen(BASHFUNC_PREFIX */
+ #define BASHFUNC_SUFFIX		"%%"
+ #define BASHFUNC_SUFFLEN	2	/* == strlen(BASHFUNC_SUFFIX) */
+ 
  extern char **environ;
  
***************
*** 280,284 ****
  static void dispose_temporary_env __P((sh_free_func_t *));     
  
! static inline char *mk_env_string __P((const char *, const char *));
  static char **make_env_array_from_var_list __P((SHELL_VAR **));
  static char **make_var_export_array __P((VAR_CONTEXT *));
--- 285,289 ----
  static void dispose_temporary_env __P((sh_free_func_t *));     
  
! static inline char *mk_env_string __P((const char *, const char *, int));
  static char **make_env_array_from_var_list __P((SHELL_VAR **));
  static char **make_var_export_array __P((VAR_CONTEXT *));
***************
*** 350,369 ****
        /* If exported function, define it now.  Don't import functions from
  	 the environment in privileged mode. */
!       if (privmode == 0 && read_but_dont_execute == 0 && STREQN ("() {", string, 4))
  	{
  	  string_length = strlen (string);
! 	  temp_string = (char *)xmalloc (3 + string_length + char_index);
  
! 	  strcpy (temp_string, name);
! 	  temp_string[char_index] = ' ';
! 	  strcpy (temp_string + char_index + 1, string);
  
  	  /* Don't import function names that are invalid identifiers from the
  	     environment, though we still allow them to be defined as shell
  	     variables. */
! 	  if (legal_identifier (name))
! 	    parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD);
  
! 	  if (temp_var = find_function (name))
  	    {
  	      VSETATTR (temp_var, (att_exported|att_imported));
--- 355,385 ----
        /* If exported function, define it now.  Don't import functions from
  	 the environment in privileged mode. */
!       if (privmode == 0 && read_but_dont_execute == 0 && 
!           STREQN (BASHFUNC_PREFIX, name, BASHFUNC_PREFLEN) &&
!           STREQ (BASHFUNC_SUFFIX, name + char_index - BASHFUNC_SUFFLEN) &&
! 	  STREQN ("() {", string, 4))
  	{
+ 	  size_t namelen;
+ 	  char *tname;		/* desired imported function name */
+ 
+ 	  namelen = char_index - BASHFUNC_PREFLEN - BASHFUNC_SUFFLEN;
+ 
+ 	  tname = name + BASHFUNC_PREFLEN;	/* start of func name */
+ 	  tname[namelen] = '\0';		/* now tname == func name */
+ 
  	  string_length = strlen (string);
! 	  temp_string = (char *)xmalloc (namelen + string_length + 2);
  
! 	  memcpy (temp_string, tname, namelen);
! 	  temp_string[namelen] = ' ';
! 	  memcpy (temp_string + namelen + 1, string, string_length + 1);
  
  	  /* Don't import function names that are invalid identifiers from the
  	     environment, though we still allow them to be defined as shell
  	     variables. */
! 	  if (absolute_program (tname) == 0 && (posixly_correct == 0 || legal_identifier (tname)))
! 	    parse_and_execute (temp_string, tname, SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD);
  
! 	  if (temp_var = find_function (tname))
  	    {
  	      VSETATTR (temp_var, (att_exported|att_imported));
***************
*** 378,383 ****
  		}
  	      last_command_exit_value = 1;
! 	      report_error (_("error importing function definition for `%s'"), name);
  	    }
  	}
  #if defined (ARRAY_VARS)
--- 394,402 ----
  		}
  	      last_command_exit_value = 1;
! 	      report_error (_("error importing function definition for `%s'"), tname);
  	    }
+ 
+ 	  /* Restore original suffix */
+ 	  tname[namelen] = BASHFUNC_SUFFIX[0];
  	}
  #if defined (ARRAY_VARS)
***************
*** 2955,2959 ****
  
    INVALIDATE_EXPORTSTR (var);
!   var->exportstr = mk_env_string (name, value);
  
    array_needs_making = 1;
--- 2974,2978 ----
  
    INVALIDATE_EXPORTSTR (var);
!   var->exportstr = mk_env_string (name, value, 0);
  
    array_needs_making = 1;
***************
*** 3853,3871 ****
  
  static inline char *
! mk_env_string (name, value)
       const char *name, *value;
  {
!   int name_len, value_len;
!   char	*p;
  
    name_len = strlen (name);
    value_len = STRLEN (value);
!   p = (char *)xmalloc (2 + name_len + value_len);
!   strcpy (p, name);
!   p[name_len] = '=';
    if (value && *value)
!     strcpy (p + name_len + 1, value);
    else
!     p[name_len + 1] = '\0';
    return (p);
  }
--- 3872,3911 ----
  
  static inline char *
! mk_env_string (name, value, isfunc)
       const char *name, *value;
+      int isfunc;
  {
!   size_t name_len, value_len;
!   char	*p, *q;
  
    name_len = strlen (name);
    value_len = STRLEN (value);
! 
!   /* If we are exporting a shell function, construct the encoded function
!      name. */
!   if (isfunc && value)
!     {
!       p = (char *)xmalloc (BASHFUNC_PREFLEN + name_len + BASHFUNC_SUFFLEN + value_len + 2);
!       q = p;
!       memcpy (q, BASHFUNC_PREFIX, BASHFUNC_PREFLEN);
!       q += BASHFUNC_PREFLEN;
!       memcpy (q, name, name_len);
!       q += name_len;
!       memcpy (q, BASHFUNC_SUFFIX, BASHFUNC_SUFFLEN);
!       q += BASHFUNC_SUFFLEN;
!     }
!   else
!     {
!       p = (char *)xmalloc (2 + name_len + value_len);
!       memcpy (p, name, name_len);
!       q = p + name_len;
!     }
! 
!   q[0] = '=';
    if (value && *value)
!     memcpy (q + 1, value, value_len + 1);
    else
!     q[1] = '\0';
! 
    return (p);
  }
***************
*** 3953,3957 ****
  	     using the cached exportstr... */
  	  list[list_index] = USE_EXPORTSTR ? savestring (value)
! 					   : mk_env_string (var->name, value);
  
  	  if (USE_EXPORTSTR == 0)
--- 3993,3997 ----
  	     using the cached exportstr... */
  	  list[list_index] = USE_EXPORTSTR ? savestring (value)
! 					   : mk_env_string (var->name, value, function_p (var));
  
  	  if (USE_EXPORTSTR == 0)
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 26
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 27
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-028

Bug-Reported-by:	Florian Weimer <fweimer@redhat.com>
Bug-Reference-ID:
Bug-Reference-URL:

Bug-Description:

There are two local buffer overflows in parse.y that can cause the shell
to dump core when given many here-documents attached to a single command
or many nested loops.

Patch (apply with `patch -p0'):

*** ../bash-4.3-patched/parse.y	2014-09-25 23:02:35.000000000 -0400
--- parse.y	2014-09-29 16:47:03.000000000 -0400
***************
*** 169,172 ****
--- 169,175 ----
  static int reserved_word_acceptable __P((int));
  static int yylex __P((void));
+ 
+ static void push_heredoc __P((REDIRECT *));
+ static char *mk_alexpansion __P((char *));
  static int alias_expand_token __P((char *));
  static int time_command_acceptable __P((void));
***************
*** 266,270 ****
  /* Variables to manage the task of reading here documents, because we need to
     defer the reading until after a complete command has been collected. */
! static REDIRECT *redir_stack[10];
  int need_here_doc;
  
--- 269,275 ----
  /* Variables to manage the task of reading here documents, because we need to
     defer the reading until after a complete command has been collected. */
! #define HEREDOC_MAX 16
! 
! static REDIRECT *redir_stack[HEREDOC_MAX];
  int need_here_doc;
  
***************
*** 308,312 ****
     index is decremented after a case, select, or for command is parsed. */
  #define MAX_CASE_NEST	128
! static int word_lineno[MAX_CASE_NEST];
  static int word_top = -1;
  
--- 313,317 ----
     index is decremented after a case, select, or for command is parsed. */
  #define MAX_CASE_NEST	128
! static int word_lineno[MAX_CASE_NEST+1];
  static int word_top = -1;
  
***************
*** 521,525 ****
  			  redir.filename = $2;
  			  $$ = make_redirection (source, r_reading_until, redir, 0);
! 			  redir_stack[need_here_doc++] = $$;
  			}
  	|	NUMBER LESS_LESS WORD
--- 526,530 ----
  			  redir.filename = $2;
  			  $$ = make_redirection (source, r_reading_until, redir, 0);
! 			  push_heredoc ($$);
  			}
  	|	NUMBER LESS_LESS WORD
***************
*** 528,532 ****
  			  redir.filename = $3;
  			  $$ = make_redirection (source, r_reading_until, redir, 0);
! 			  redir_stack[need_here_doc++] = $$;
  			}
  	|	REDIR_WORD LESS_LESS WORD
--- 533,537 ----
  			  redir.filename = $3;
  			  $$ = make_redirection (source, r_reading_until, redir, 0);
! 			  push_heredoc ($$);
  			}
  	|	REDIR_WORD LESS_LESS WORD
***************
*** 535,539 ****
  			  redir.filename = $3;
  			  $$ = make_redirection (source, r_reading_until, redir, REDIR_VARASSIGN);
! 			  redir_stack[need_here_doc++] = $$;
  			}
  	|	LESS_LESS_MINUS WORD
--- 540,544 ----
  			  redir.filename = $3;
  			  $$ = make_redirection (source, r_reading_until, redir, REDIR_VARASSIGN);
! 			  push_heredoc ($$);
  			}
  	|	LESS_LESS_MINUS WORD
***************
*** 542,546 ****
  			  redir.filename = $2;
  			  $$ = make_redirection (source, r_deblank_reading_until, redir, 0);
! 			  redir_stack[need_here_doc++] = $$;
  			}
  	|	NUMBER LESS_LESS_MINUS WORD
--- 547,551 ----
  			  redir.filename = $2;
  			  $$ = make_redirection (source, r_deblank_reading_until, redir, 0);
! 			  push_heredoc ($$);
  			}
  	|	NUMBER LESS_LESS_MINUS WORD
***************
*** 549,553 ****
  			  redir.filename = $3;
  			  $$ = make_redirection (source, r_deblank_reading_until, redir, 0);
! 			  redir_stack[need_here_doc++] = $$;
  			}
  	|	REDIR_WORD  LESS_LESS_MINUS WORD
--- 554,558 ----
  			  redir.filename = $3;
  			  $$ = make_redirection (source, r_deblank_reading_until, redir, 0);
! 			  push_heredoc ($$);
  			}
  	|	REDIR_WORD  LESS_LESS_MINUS WORD
***************
*** 556,560 ****
  			  redir.filename = $3;
  			  $$ = make_redirection (source, r_deblank_reading_until, redir, REDIR_VARASSIGN);
! 			  redir_stack[need_here_doc++] = $$;
  			}
  	|	LESS_LESS_LESS WORD
--- 561,565 ----
  			  redir.filename = $3;
  			  $$ = make_redirection (source, r_deblank_reading_until, redir, REDIR_VARASSIGN);
! 			  push_heredoc ($$);
  			}
  	|	LESS_LESS_LESS WORD
***************
*** 2637,2640 ****
--- 2642,2660 ----
  static int esacs_needed_count;
  
+ static void
+ push_heredoc (r)
+      REDIRECT *r;
+ {
+   if (need_here_doc >= HEREDOC_MAX)
+     {
+       last_command_exit_value = EX_BADUSAGE;
+       need_here_doc = 0;
+       report_syntax_error (_("maximum here-document count exceeded"));
+       reset_parser ();
+       exit_shell (last_command_exit_value);
+     }
+   redir_stack[need_here_doc++] = r;
+ }
+ 
  void
  gather_here_documents ()
*** ../bash-4.3.27/y.tab.c	2014-10-01 11:38:24.000000000 -0400
--- y.tab.c	2014-10-01 12:46:11.000000000 -0400
***************
*** 169,173 ****
  
  /* Copy the first part of user declarations.  */
! #line 21 "/usr/homes/chet/src/bash/src/parse.y"
  
  #include "config.h"
--- 169,173 ----
  
  /* Copy the first part of user declarations.  */
! #line 21 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
  
  #include "config.h"
***************
*** 320,323 ****
--- 320,326 ----
  static int reserved_word_acceptable __P((int));
  static int yylex __P((void));
+ 
+ static void push_heredoc __P((REDIRECT *));
+ static char *mk_alexpansion __P((char *));
  static int alias_expand_token __P((char *));
  static int time_command_acceptable __P((void));
***************
*** 417,421 ****
  /* Variables to manage the task of reading here documents, because we need to
     defer the reading until after a complete command has been collected. */
! static REDIRECT *redir_stack[10];
  int need_here_doc;
  
--- 420,426 ----
  /* Variables to manage the task of reading here documents, because we need to
     defer the reading until after a complete command has been collected. */
! #define HEREDOC_MAX 16
! 
! static REDIRECT *redir_stack[HEREDOC_MAX];
  int need_here_doc;
  
***************
*** 459,463 ****
     index is decremented after a case, select, or for command is parsed. */
  #define MAX_CASE_NEST	128
! static int word_lineno[MAX_CASE_NEST];
  static int word_top = -1;
  
--- 464,468 ----
     index is decremented after a case, select, or for command is parsed. */
  #define MAX_CASE_NEST	128
! static int word_lineno[MAX_CASE_NEST+1];
  static int word_top = -1;
  
***************
*** 493,497 ****
  #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
  typedef union YYSTYPE
! #line 324 "/usr/homes/chet/src/bash/src/parse.y"
  {
    WORD_DESC *word;		/* the word that we read. */
--- 498,502 ----
  #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
  typedef union YYSTYPE
! #line 329 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
  {
    WORD_DESC *word;		/* the word that we read. */
***************
*** 504,508 ****
  }
  /* Line 193 of yacc.c.  */
! #line 507 "y.tab.c"
  	YYSTYPE;
  # define yystype YYSTYPE /* obsolescent; will be withdrawn */
--- 509,513 ----
  }
  /* Line 193 of yacc.c.  */
! #line 512 "y.tab.c"
  	YYSTYPE;
  # define yystype YYSTYPE /* obsolescent; will be withdrawn */
***************
*** 517,521 ****
  
  /* Line 216 of yacc.c.  */
! #line 520 "y.tab.c"
  
  #ifdef short
--- 522,526 ----
  
  /* Line 216 of yacc.c.  */
! #line 525 "y.tab.c"
  
  #ifdef short
***************
*** 887,907 ****
  static const yytype_uint16 yyrline[] =
  {
!        0,   377,   377,   388,   397,   412,   422,   424,   428,   434,
!      440,   446,   452,   458,   464,   470,   476,   482,   488,   494,
!      500,   506,   512,   518,   525,   532,   539,   546,   553,   560,
!      566,   572,   578,   584,   590,   596,   602,   608,   614,   620,
!      626,   632,   638,   644,   650,   656,   662,   668,   674,   680,
!      686,   692,   700,   702,   704,   708,   712,   723,   725,   729,
!      731,   733,   749,   751,   755,   757,   759,   761,   763,   765,
!      767,   769,   771,   773,   775,   779,   784,   789,   794,   799,
!      804,   809,   814,   821,   826,   831,   836,   843,   848,   853,
!      858,   863,   868,   875,   880,   885,   892,   895,   898,   902,
!      904,   935,   942,   947,   964,   969,   986,   993,   995,   997,
!     1002,  1006,  1010,  1014,  1016,  1018,  1022,  1023,  1027,  1029,
!     1031,  1033,  1037,  1039,  1041,  1043,  1045,  1047,  1051,  1053,
!     1062,  1070,  1071,  1077,  1078,  1085,  1089,  1091,  1093,  1100,
!     1102,  1104,  1108,  1109,  1112,  1114,  1116,  1120,  1121,  1130,
!     1143,  1159,  1174,  1176,  1178,  1185,  1188,  1192,  1194,  1200,
!     1206,  1223,  1243,  1245,  1268,  1272,  1274,  1276
  };
  #endif
--- 892,912 ----
  static const yytype_uint16 yyrline[] =
  {
!        0,   382,   382,   393,   402,   417,   427,   429,   433,   439,
!      445,   451,   457,   463,   469,   475,   481,   487,   493,   499,
!      505,   511,   517,   523,   530,   537,   544,   551,   558,   565,
!      571,   577,   583,   589,   595,   601,   607,   613,   619,   625,
!      631,   637,   643,   649,   655,   661,   667,   673,   679,   685,
!      691,   697,   705,   707,   709,   713,   717,   728,   730,   734,
!      736,   738,   754,   756,   760,   762,   764,   766,   768,   770,
!      772,   774,   776,   778,   780,   784,   789,   794,   799,   804,
!      809,   814,   819,   826,   831,   836,   841,   848,   853,   858,
!      863,   868,   873,   880,   885,   890,   897,   900,   903,   907,
!      909,   940,   947,   952,   969,   974,   991,   998,  1000,  1002,
!     1007,  1011,  1015,  1019,  1021,  1023,  1027,  1028,  1032,  1034,
!     1036,  1038,  1042,  1044,  1046,  1048,  1050,  1052,  1056,  1058,
!     1067,  1075,  1076,  1082,  1083,  1090,  1094,  1096,  1098,  1105,
!     1107,  1109,  1113,  1114,  1117,  1119,  1121,  1125,  1126,  1135,
!     1148,  1164,  1179,  1181,  1183,  1190,  1193,  1197,  1199,  1205,
!     1211,  1228,  1248,  1250,  1273,  1277,  1279,  1281
  };
  #endif
***************
*** 2094,2098 ****
      {
          case 2:
! #line 378 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  /* Case of regular command.  Discard the error
--- 2099,2103 ----
      {
          case 2:
! #line 383 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  /* Case of regular command.  Discard the error
***************
*** 2108,2112 ****
  
    case 3:
! #line 389 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  /* Case of regular command, but not a very
--- 2113,2117 ----
  
    case 3:
! #line 394 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  /* Case of regular command, but not a very
***************
*** 2120,2124 ****
  
    case 4:
! #line 398 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  /* Error during parsing.  Return NULL command. */
--- 2125,2129 ----
  
    case 4:
! #line 403 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  /* Error during parsing.  Return NULL command. */
***************
*** 2138,2142 ****
  
    case 5:
! #line 413 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  /* Case of EOF seen by itself.  Do ignoreeof or
--- 2143,2147 ----
  
    case 5:
! #line 418 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  /* Case of EOF seen by itself.  Do ignoreeof or
***************
*** 2149,2163 ****
  
    case 6:
! #line 423 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.word_list) = make_word_list ((yyvsp[(1) - (1)].word), (WORD_LIST *)NULL); }
      break;
  
    case 7:
! #line 425 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.word_list) = make_word_list ((yyvsp[(2) - (2)].word), (yyvsp[(1) - (2)].word_list)); }
      break;
  
    case 8:
! #line 429 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = 1;
--- 2154,2168 ----
  
    case 6:
! #line 428 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.word_list) = make_word_list ((yyvsp[(1) - (1)].word), (WORD_LIST *)NULL); }
      break;
  
    case 7:
! #line 430 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.word_list) = make_word_list ((yyvsp[(2) - (2)].word), (yyvsp[(1) - (2)].word_list)); }
      break;
  
    case 8:
! #line 434 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = 1;
***************
*** 2168,2172 ****
  
    case 9:
! #line 435 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = 0;
--- 2173,2177 ----
  
    case 9:
! #line 440 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = 0;
***************
*** 2177,2181 ****
  
    case 10:
! #line 441 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
--- 2182,2186 ----
  
    case 10:
! #line 446 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
***************
*** 2186,2190 ****
  
    case 11:
! #line 447 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
--- 2191,2195 ----
  
    case 11:
! #line 452 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
***************
*** 2195,2199 ****
  
    case 12:
! #line 453 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
--- 2200,2204 ----
  
    case 12:
! #line 458 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
***************
*** 2204,2208 ****
  
    case 13:
! #line 459 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
--- 2209,2213 ----
  
    case 13:
! #line 464 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
***************
*** 2213,2217 ****
  
    case 14:
! #line 465 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = 1;
--- 2218,2222 ----
  
    case 14:
! #line 470 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = 1;
***************
*** 2222,2226 ****
  
    case 15:
! #line 471 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
--- 2227,2231 ----
  
    case 15:
! #line 476 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
***************
*** 2231,2235 ****
  
    case 16:
! #line 477 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
--- 2236,2240 ----
  
    case 16:
! #line 482 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
***************
*** 2240,2244 ****
  
    case 17:
! #line 483 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = 1;
--- 2245,2249 ----
  
    case 17:
! #line 488 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = 1;
***************
*** 2249,2253 ****
  
    case 18:
! #line 489 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
--- 2254,2258 ----
  
    case 18:
! #line 494 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
***************
*** 2258,2262 ****
  
    case 19:
! #line 495 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
--- 2263,2267 ----
  
    case 19:
! #line 500 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
***************
*** 2267,2271 ****
  
    case 20:
! #line 501 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = 0;
--- 2272,2276 ----
  
    case 20:
! #line 506 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = 0;
***************
*** 2276,2280 ****
  
    case 21:
! #line 507 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
--- 2281,2285 ----
  
    case 21:
! #line 512 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
***************
*** 2285,2289 ****
  
    case 22:
! #line 513 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
--- 2290,2294 ----
  
    case 22:
! #line 518 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
***************
*** 2294,2358 ****
  
    case 23:
! #line 519 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = 0;
  			  redir.filename = (yyvsp[(2) - (2)].word);
  			  (yyval.redirect) = make_redirection (source, r_reading_until, redir, 0);
! 			  redir_stack[need_here_doc++] = (yyval.redirect);
  			}
      break;
  
    case 24:
! #line 526 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
  			  redir.filename = (yyvsp[(3) - (3)].word);
  			  (yyval.redirect) = make_redirection (source, r_reading_until, redir, 0);
! 			  redir_stack[need_here_doc++] = (yyval.redirect);
  			}
      break;
  
    case 25:
! #line 533 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
  			  redir.filename = (yyvsp[(3) - (3)].word);
  			  (yyval.redirect) = make_redirection (source, r_reading_until, redir, REDIR_VARASSIGN);
! 			  redir_stack[need_here_doc++] = (yyval.redirect);
  			}
      break;
  
    case 26:
! #line 540 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = 0;
  			  redir.filename = (yyvsp[(2) - (2)].word);
  			  (yyval.redirect) = make_redirection (source, r_deblank_reading_until, redir, 0);
! 			  redir_stack[need_here_doc++] = (yyval.redirect);
  			}
      break;
  
    case 27:
! #line 547 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
  			  redir.filename = (yyvsp[(3) - (3)].word);
  			  (yyval.redirect) = make_redirection (source, r_deblank_reading_until, redir, 0);
! 			  redir_stack[need_here_doc++] = (yyval.redirect);
  			}
      break;
  
    case 28:
! #line 554 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
  			  redir.filename = (yyvsp[(3) - (3)].word);
  			  (yyval.redirect) = make_redirection (source, r_deblank_reading_until, redir, REDIR_VARASSIGN);
! 			  redir_stack[need_here_doc++] = (yyval.redirect);
  			}
      break;
  
    case 29:
! #line 561 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = 0;
--- 2299,2363 ----
  
    case 23:
! #line 524 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = 0;
  			  redir.filename = (yyvsp[(2) - (2)].word);
  			  (yyval.redirect) = make_redirection (source, r_reading_until, redir, 0);
! 			  push_heredoc ((yyval.redirect));
  			}
      break;
  
    case 24:
! #line 531 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
  			  redir.filename = (yyvsp[(3) - (3)].word);
  			  (yyval.redirect) = make_redirection (source, r_reading_until, redir, 0);
! 			  push_heredoc ((yyval.redirect));
  			}
      break;
  
    case 25:
! #line 538 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
  			  redir.filename = (yyvsp[(3) - (3)].word);
  			  (yyval.redirect) = make_redirection (source, r_reading_until, redir, REDIR_VARASSIGN);
! 			  push_heredoc ((yyval.redirect));
  			}
      break;
  
    case 26:
! #line 545 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = 0;
  			  redir.filename = (yyvsp[(2) - (2)].word);
  			  (yyval.redirect) = make_redirection (source, r_deblank_reading_until, redir, 0);
! 			  push_heredoc ((yyval.redirect));
  			}
      break;
  
    case 27:
! #line 552 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
  			  redir.filename = (yyvsp[(3) - (3)].word);
  			  (yyval.redirect) = make_redirection (source, r_deblank_reading_until, redir, 0);
! 			  push_heredoc ((yyval.redirect));
  			}
      break;
  
    case 28:
! #line 559 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
  			  redir.filename = (yyvsp[(3) - (3)].word);
  			  (yyval.redirect) = make_redirection (source, r_deblank_reading_until, redir, REDIR_VARASSIGN);
! 			  push_heredoc ((yyval.redirect));
  			}
      break;
  
    case 29:
! #line 566 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = 0;
***************
*** 2363,2367 ****
  
    case 30:
! #line 567 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
--- 2368,2372 ----
  
    case 30:
! #line 572 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
***************
*** 2372,2376 ****
  
    case 31:
! #line 573 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
--- 2377,2381 ----
  
    case 31:
! #line 578 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
***************
*** 2381,2385 ****
  
    case 32:
! #line 579 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = 0;
--- 2386,2390 ----
  
    case 32:
! #line 584 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = 0;
***************
*** 2390,2394 ****
  
    case 33:
! #line 585 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
--- 2395,2399 ----
  
    case 33:
! #line 590 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
***************
*** 2399,2403 ****
  
    case 34:
! #line 591 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
--- 2404,2408 ----
  
    case 34:
! #line 596 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
***************
*** 2408,2412 ****
  
    case 35:
! #line 597 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = 1;
--- 2413,2417 ----
  
    case 35:
! #line 602 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = 1;
***************
*** 2417,2421 ****
  
    case 36:
! #line 603 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
--- 2422,2426 ----
  
    case 36:
! #line 608 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
***************
*** 2426,2430 ****
  
    case 37:
! #line 609 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
--- 2431,2435 ----
  
    case 37:
! #line 614 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
***************
*** 2435,2439 ****
  
    case 38:
! #line 615 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = 0;
--- 2440,2444 ----
  
    case 38:
! #line 620 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = 0;
***************
*** 2444,2448 ****
  
    case 39:
! #line 621 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
--- 2449,2453 ----
  
    case 39:
! #line 626 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
***************
*** 2453,2457 ****
  
    case 40:
! #line 627 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
--- 2458,2462 ----
  
    case 40:
! #line 632 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
***************
*** 2462,2466 ****
  
    case 41:
! #line 633 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = 1;
--- 2467,2471 ----
  
    case 41:
! #line 638 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = 1;
***************
*** 2471,2475 ****
  
    case 42:
! #line 639 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
--- 2476,2480 ----
  
    case 42:
! #line 644 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
***************
*** 2480,2484 ****
  
    case 43:
! #line 645 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
--- 2485,2489 ----
  
    case 43:
! #line 650 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
***************
*** 2489,2493 ****
  
    case 44:
! #line 651 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = 1;
--- 2494,2498 ----
  
    case 44:
! #line 656 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = 1;
***************
*** 2498,2502 ****
  
    case 45:
! #line 657 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
--- 2503,2507 ----
  
    case 45:
! #line 662 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
***************
*** 2507,2511 ****
  
    case 46:
! #line 663 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
--- 2512,2516 ----
  
    case 46:
! #line 668 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
***************
*** 2516,2520 ****
  
    case 47:
! #line 669 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = 0;
--- 2521,2525 ----
  
    case 47:
! #line 674 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = 0;
***************
*** 2525,2529 ****
  
    case 48:
! #line 675 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
--- 2530,2534 ----
  
    case 48:
! #line 680 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = (yyvsp[(1) - (3)].number);
***************
*** 2534,2538 ****
  
    case 49:
! #line 681 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
--- 2539,2543 ----
  
    case 49:
! #line 686 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.filename = (yyvsp[(1) - (3)].word);
***************
*** 2543,2547 ****
  
    case 50:
! #line 687 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = 1;
--- 2548,2552 ----
  
    case 50:
! #line 692 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = 1;
***************
*** 2552,2556 ****
  
    case 51:
! #line 693 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  source.dest = 1;
--- 2557,2561 ----
  
    case 51:
! #line 698 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  source.dest = 1;
***************
*** 2561,2580 ****
  
    case 52:
! #line 701 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.element).word = (yyvsp[(1) - (1)].word); (yyval.element).redirect = 0; }
      break;
  
    case 53:
! #line 703 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.element).word = (yyvsp[(1) - (1)].word); (yyval.element).redirect = 0; }
      break;
  
    case 54:
! #line 705 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.element).redirect = (yyvsp[(1) - (1)].redirect); (yyval.element).word = 0; }
      break;
  
    case 55:
! #line 709 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.redirect) = (yyvsp[(1) - (1)].redirect);
--- 2566,2585 ----
  
    case 52:
! #line 706 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.element).word = (yyvsp[(1) - (1)].word); (yyval.element).redirect = 0; }
      break;
  
    case 53:
! #line 708 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.element).word = (yyvsp[(1) - (1)].word); (yyval.element).redirect = 0; }
      break;
  
    case 54:
! #line 710 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.element).redirect = (yyvsp[(1) - (1)].redirect); (yyval.element).word = 0; }
      break;
  
    case 55:
! #line 714 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.redirect) = (yyvsp[(1) - (1)].redirect);
***************
*** 2583,2587 ****
  
    case 56:
! #line 713 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  register REDIRECT *t;
--- 2588,2592 ----
  
    case 56:
! #line 718 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  register REDIRECT *t;
***************
*** 2595,2619 ****
  
    case 57:
! #line 724 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = make_simple_command ((yyvsp[(1) - (1)].element), (COMMAND *)NULL); }
      break;
  
    case 58:
! #line 726 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = make_simple_command ((yyvsp[(2) - (2)].element), (yyvsp[(1) - (2)].command)); }
      break;
  
    case 59:
! #line 730 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = clean_simple_command ((yyvsp[(1) - (1)].command)); }
      break;
  
    case 60:
! #line 732 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 61:
! #line 734 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  COMMAND *tc;
--- 2600,2624 ----
  
    case 57:
! #line 729 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = make_simple_command ((yyvsp[(1) - (1)].element), (COMMAND *)NULL); }
      break;
  
    case 58:
! #line 731 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = make_simple_command ((yyvsp[(2) - (2)].element), (yyvsp[(1) - (2)].command)); }
      break;
  
    case 59:
! #line 735 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = clean_simple_command ((yyvsp[(1) - (1)].command)); }
      break;
  
    case 60:
! #line 737 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 61:
! #line 739 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  COMMAND *tc;
***************
*** 2634,2703 ****
  
    case 62:
! #line 750 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 63:
! #line 752 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 64:
! #line 756 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 65:
! #line 758 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 66:
! #line 760 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = make_while_command ((yyvsp[(2) - (5)].command), (yyvsp[(4) - (5)].command)); }
      break;
  
    case 67:
! #line 762 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = make_until_command ((yyvsp[(2) - (5)].command), (yyvsp[(4) - (5)].command)); }
      break;
  
    case 68:
! #line 764 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 69:
! #line 766 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 70:
! #line 768 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 71:
! #line 770 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 72:
! #line 772 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 73:
! #line 774 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 74:
! #line 776 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 75:
! #line 780 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = make_for_command ((yyvsp[(2) - (6)].word), add_string_to_list ("\"$@\"", (WORD_LIST *)NULL), (yyvsp[(5) - (6)].command), word_lineno[word_top]);
--- 2639,2708 ----
  
    case 62:
! #line 755 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 63:
! #line 757 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 64:
! #line 761 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 65:
! #line 763 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 66:
! #line 765 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = make_while_command ((yyvsp[(2) - (5)].command), (yyvsp[(4) - (5)].command)); }
      break;
  
    case 67:
! #line 767 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = make_until_command ((yyvsp[(2) - (5)].command), (yyvsp[(4) - (5)].command)); }
      break;
  
    case 68:
! #line 769 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 69:
! #line 771 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 70:
! #line 773 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 71:
! #line 775 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 72:
! #line 777 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 73:
! #line 779 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 74:
! #line 781 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 75:
! #line 785 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = make_for_command ((yyvsp[(2) - (6)].word), add_string_to_list ("\"$@\"", (WORD_LIST *)NULL), (yyvsp[(5) - (6)].command), word_lineno[word_top]);
***************
*** 2707,2711 ****
  
    case 76:
! #line 785 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = make_for_command ((yyvsp[(2) - (6)].word), add_string_to_list ("\"$@\"", (WORD_LIST *)NULL), (yyvsp[(5) - (6)].command), word_lineno[word_top]);
--- 2712,2716 ----
  
    case 76:
! #line 790 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = make_for_command ((yyvsp[(2) - (6)].word), add_string_to_list ("\"$@\"", (WORD_LIST *)NULL), (yyvsp[(5) - (6)].command), word_lineno[word_top]);
***************
*** 2715,2719 ****
  
    case 77:
! #line 790 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = make_for_command ((yyvsp[(2) - (7)].word), add_string_to_list ("\"$@\"", (WORD_LIST *)NULL), (yyvsp[(6) - (7)].command), word_lineno[word_top]);
--- 2720,2724 ----
  
    case 77:
! #line 795 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = make_for_command ((yyvsp[(2) - (7)].word), add_string_to_list ("\"$@\"", (WORD_LIST *)NULL), (yyvsp[(6) - (7)].command), word_lineno[word_top]);
***************
*** 2723,2727 ****
  
    case 78:
! #line 795 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = make_for_command ((yyvsp[(2) - (7)].word), add_string_to_list ("\"$@\"", (WORD_LIST *)NULL), (yyvsp[(6) - (7)].command), word_lineno[word_top]);
--- 2728,2732 ----
  
    case 78:
! #line 800 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = make_for_command ((yyvsp[(2) - (7)].word), add_string_to_list ("\"$@\"", (WORD_LIST *)NULL), (yyvsp[(6) - (7)].command), word_lineno[word_top]);
***************
*** 2731,2735 ****
  
    case 79:
! #line 800 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = make_for_command ((yyvsp[(2) - (10)].word), REVERSE_LIST ((yyvsp[(5) - (10)].word_list), WORD_LIST *), (yyvsp[(9) - (10)].command), word_lineno[word_top]);
--- 2736,2740 ----
  
    case 79:
! #line 805 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = make_for_command ((yyvsp[(2) - (10)].word), REVERSE_LIST ((yyvsp[(5) - (10)].word_list), WORD_LIST *), (yyvsp[(9) - (10)].command), word_lineno[word_top]);
***************
*** 2739,2743 ****
  
    case 80:
! #line 805 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = make_for_command ((yyvsp[(2) - (10)].word), REVERSE_LIST ((yyvsp[(5) - (10)].word_list), WORD_LIST *), (yyvsp[(9) - (10)].command), word_lineno[word_top]);
--- 2744,2748 ----
  
    case 80:
! #line 810 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = make_for_command ((yyvsp[(2) - (10)].word), REVERSE_LIST ((yyvsp[(5) - (10)].word_list), WORD_LIST *), (yyvsp[(9) - (10)].command), word_lineno[word_top]);
***************
*** 2747,2751 ****
  
    case 81:
! #line 810 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = make_for_command ((yyvsp[(2) - (9)].word), (WORD_LIST *)NULL, (yyvsp[(8) - (9)].command), word_lineno[word_top]);
--- 2752,2756 ----
  
    case 81:
! #line 815 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = make_for_command ((yyvsp[(2) - (9)].word), (WORD_LIST *)NULL, (yyvsp[(8) - (9)].command), word_lineno[word_top]);
***************
*** 2755,2759 ****
  
    case 82:
! #line 815 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = make_for_command ((yyvsp[(2) - (9)].word), (WORD_LIST *)NULL, (yyvsp[(8) - (9)].command), word_lineno[word_top]);
--- 2760,2764 ----
  
    case 82:
! #line 820 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = make_for_command ((yyvsp[(2) - (9)].word), (WORD_LIST *)NULL, (yyvsp[(8) - (9)].command), word_lineno[word_top]);
***************
*** 2763,2767 ****
  
    case 83:
! #line 822 "/usr/homes/chet/src/bash/src/parse.y"
      {
  				  (yyval.command) = make_arith_for_command ((yyvsp[(2) - (7)].word_list), (yyvsp[(6) - (7)].command), arith_for_lineno);
--- 2768,2772 ----
  
    case 83:
! #line 827 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  				  (yyval.command) = make_arith_for_command ((yyvsp[(2) - (7)].word_list), (yyvsp[(6) - (7)].command), arith_for_lineno);
***************
*** 2771,2775 ****
  
    case 84:
! #line 827 "/usr/homes/chet/src/bash/src/parse.y"
      {
  				  (yyval.command) = make_arith_for_command ((yyvsp[(2) - (7)].word_list), (yyvsp[(6) - (7)].command), arith_for_lineno);
--- 2776,2780 ----
  
    case 84:
! #line 832 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  				  (yyval.command) = make_arith_for_command ((yyvsp[(2) - (7)].word_list), (yyvsp[(6) - (7)].command), arith_for_lineno);
***************
*** 2779,2783 ****
  
    case 85:
! #line 832 "/usr/homes/chet/src/bash/src/parse.y"
      {
  				  (yyval.command) = make_arith_for_command ((yyvsp[(2) - (5)].word_list), (yyvsp[(4) - (5)].command), arith_for_lineno);
--- 2784,2788 ----
  
    case 85:
! #line 837 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  				  (yyval.command) = make_arith_for_command ((yyvsp[(2) - (5)].word_list), (yyvsp[(4) - (5)].command), arith_for_lineno);
***************
*** 2787,2791 ****
  
    case 86:
! #line 837 "/usr/homes/chet/src/bash/src/parse.y"
      {
  				  (yyval.command) = make_arith_for_command ((yyvsp[(2) - (5)].word_list), (yyvsp[(4) - (5)].command), arith_for_lineno);
--- 2792,2796 ----
  
    case 86:
! #line 842 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  				  (yyval.command) = make_arith_for_command ((yyvsp[(2) - (5)].word_list), (yyvsp[(4) - (5)].command), arith_for_lineno);
***************
*** 2795,2799 ****
  
    case 87:
! #line 844 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = make_select_command ((yyvsp[(2) - (6)].word), add_string_to_list ("\"$@\"", (WORD_LIST *)NULL), (yyvsp[(5) - (6)].command), word_lineno[word_top]);
--- 2800,2804 ----
  
    case 87:
! #line 849 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = make_select_command ((yyvsp[(2) - (6)].word), add_string_to_list ("\"$@\"", (WORD_LIST *)NULL), (yyvsp[(5) - (6)].command), word_lineno[word_top]);
***************
*** 2803,2807 ****
  
    case 88:
! #line 849 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = make_select_command ((yyvsp[(2) - (6)].word), add_string_to_list ("\"$@\"", (WORD_LIST *)NULL), (yyvsp[(5) - (6)].command), word_lineno[word_top]);
--- 2808,2812 ----
  
    case 88:
! #line 854 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = make_select_command ((yyvsp[(2) - (6)].word), add_string_to_list ("\"$@\"", (WORD_LIST *)NULL), (yyvsp[(5) - (6)].command), word_lineno[word_top]);
***************
*** 2811,2815 ****
  
    case 89:
! #line 854 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = make_select_command ((yyvsp[(2) - (7)].word), add_string_to_list ("\"$@\"", (WORD_LIST *)NULL), (yyvsp[(6) - (7)].command), word_lineno[word_top]);
--- 2816,2820 ----
  
    case 89:
! #line 859 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = make_select_command ((yyvsp[(2) - (7)].word), add_string_to_list ("\"$@\"", (WORD_LIST *)NULL), (yyvsp[(6) - (7)].command), word_lineno[word_top]);
***************
*** 2819,2823 ****
  
    case 90:
! #line 859 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = make_select_command ((yyvsp[(2) - (7)].word), add_string_to_list ("\"$@\"", (WORD_LIST *)NULL), (yyvsp[(6) - (7)].command), word_lineno[word_top]);
--- 2824,2828 ----
  
    case 90:
! #line 864 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = make_select_command ((yyvsp[(2) - (7)].word), add_string_to_list ("\"$@\"", (WORD_LIST *)NULL), (yyvsp[(6) - (7)].command), word_lineno[word_top]);
***************
*** 2827,2831 ****
  
    case 91:
! #line 864 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = make_select_command ((yyvsp[(2) - (10)].word), REVERSE_LIST ((yyvsp[(5) - (10)].word_list), WORD_LIST *), (yyvsp[(9) - (10)].command), word_lineno[word_top]);
--- 2832,2836 ----
  
    case 91:
! #line 869 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = make_select_command ((yyvsp[(2) - (10)].word), REVERSE_LIST ((yyvsp[(5) - (10)].word_list), WORD_LIST *), (yyvsp[(9) - (10)].command), word_lineno[word_top]);
***************
*** 2835,2839 ****
  
    case 92:
! #line 869 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = make_select_command ((yyvsp[(2) - (10)].word), REVERSE_LIST ((yyvsp[(5) - (10)].word_list), WORD_LIST *), (yyvsp[(9) - (10)].command), word_lineno[word_top]);
--- 2840,2844 ----
  
    case 92:
! #line 874 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = make_select_command ((yyvsp[(2) - (10)].word), REVERSE_LIST ((yyvsp[(5) - (10)].word_list), WORD_LIST *), (yyvsp[(9) - (10)].command), word_lineno[word_top]);
***************
*** 2843,2847 ****
  
    case 93:
! #line 876 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = make_case_command ((yyvsp[(2) - (6)].word), (PATTERN_LIST *)NULL, word_lineno[word_top]);
--- 2848,2852 ----
  
    case 93:
! #line 881 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = make_case_command ((yyvsp[(2) - (6)].word), (PATTERN_LIST *)NULL, word_lineno[word_top]);
***************
*** 2851,2855 ****
  
    case 94:
! #line 881 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = make_case_command ((yyvsp[(2) - (7)].word), (yyvsp[(5) - (7)].pattern), word_lineno[word_top]);
--- 2856,2860 ----
  
    case 94:
! #line 886 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = make_case_command ((yyvsp[(2) - (7)].word), (yyvsp[(5) - (7)].pattern), word_lineno[word_top]);
***************
*** 2859,2863 ****
  
    case 95:
! #line 886 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = make_case_command ((yyvsp[(2) - (6)].word), (yyvsp[(5) - (6)].pattern), word_lineno[word_top]);
--- 2864,2868 ----
  
    case 95:
! #line 891 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = make_case_command ((yyvsp[(2) - (6)].word), (yyvsp[(5) - (6)].pattern), word_lineno[word_top]);
***************
*** 2867,2891 ****
  
    case 96:
! #line 893 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = make_function_def ((yyvsp[(1) - (5)].word), (yyvsp[(5) - (5)].command), function_dstart, function_bstart); }
      break;
  
    case 97:
! #line 896 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = make_function_def ((yyvsp[(2) - (6)].word), (yyvsp[(6) - (6)].command), function_dstart, function_bstart); }
      break;
  
    case 98:
! #line 899 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = make_function_def ((yyvsp[(2) - (4)].word), (yyvsp[(4) - (4)].command), function_dstart, function_bstart); }
      break;
  
    case 99:
! #line 903 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 100:
! #line 905 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  COMMAND *tc;
--- 2872,2896 ----
  
    case 96:
! #line 898 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = make_function_def ((yyvsp[(1) - (5)].word), (yyvsp[(5) - (5)].command), function_dstart, function_bstart); }
      break;
  
    case 97:
! #line 901 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = make_function_def ((yyvsp[(2) - (6)].word), (yyvsp[(6) - (6)].command), function_dstart, function_bstart); }
      break;
  
    case 98:
! #line 904 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = make_function_def ((yyvsp[(2) - (4)].word), (yyvsp[(4) - (4)].command), function_dstart, function_bstart); }
      break;
  
    case 99:
! #line 908 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 100:
! #line 910 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  COMMAND *tc;
***************
*** 2919,2923 ****
  
    case 101:
! #line 936 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = make_subshell_command ((yyvsp[(2) - (3)].command));
--- 2924,2928 ----
  
    case 101:
! #line 941 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = make_subshell_command ((yyvsp[(2) - (3)].command));
***************
*** 2927,2931 ****
  
    case 102:
! #line 943 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = make_coproc_command ("COPROC", (yyvsp[(2) - (2)].command));
--- 2932,2936 ----
  
    case 102:
! #line 948 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = make_coproc_command ("COPROC", (yyvsp[(2) - (2)].command));
***************
*** 2935,2939 ****
  
    case 103:
! #line 948 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  COMMAND *tc;
--- 2940,2944 ----
  
    case 103:
! #line 953 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  COMMAND *tc;
***************
*** 2955,2959 ****
  
    case 104:
! #line 965 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = make_coproc_command ((yyvsp[(2) - (3)].word)->word, (yyvsp[(3) - (3)].command));
--- 2960,2964 ----
  
    case 104:
! #line 970 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = make_coproc_command ((yyvsp[(2) - (3)].word)->word, (yyvsp[(3) - (3)].command));
***************
*** 2963,2967 ****
  
    case 105:
! #line 970 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  COMMAND *tc;
--- 2968,2972 ----
  
    case 105:
! #line 975 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  COMMAND *tc;
***************
*** 2983,2987 ****
  
    case 106:
! #line 987 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = make_coproc_command ("COPROC", clean_simple_command ((yyvsp[(2) - (2)].command)));
--- 2988,2992 ----
  
    case 106:
! #line 992 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = make_coproc_command ("COPROC", clean_simple_command ((yyvsp[(2) - (2)].command)));
***************
*** 2991,3105 ****
  
    case 107:
! #line 994 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = make_if_command ((yyvsp[(2) - (5)].command), (yyvsp[(4) - (5)].command), (COMMAND *)NULL); }
      break;
  
    case 108:
! #line 996 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = make_if_command ((yyvsp[(2) - (7)].command), (yyvsp[(4) - (7)].command), (yyvsp[(6) - (7)].command)); }
      break;
  
    case 109:
! #line 998 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = make_if_command ((yyvsp[(2) - (6)].command), (yyvsp[(4) - (6)].command), (yyvsp[(5) - (6)].command)); }
      break;
  
    case 110:
! #line 1003 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = make_group_command ((yyvsp[(2) - (3)].command)); }
      break;
  
    case 111:
! #line 1007 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = make_arith_command ((yyvsp[(1) - (1)].word_list)); }
      break;
  
    case 112:
! #line 1011 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = (yyvsp[(2) - (3)].command); }
      break;
  
    case 113:
! #line 1015 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = make_if_command ((yyvsp[(2) - (4)].command), (yyvsp[(4) - (4)].command), (COMMAND *)NULL); }
      break;
  
    case 114:
! #line 1017 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = make_if_command ((yyvsp[(2) - (6)].command), (yyvsp[(4) - (6)].command), (yyvsp[(6) - (6)].command)); }
      break;
  
    case 115:
! #line 1019 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = make_if_command ((yyvsp[(2) - (5)].command), (yyvsp[(4) - (5)].command), (yyvsp[(5) - (5)].command)); }
      break;
  
    case 117:
! #line 1024 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyvsp[(2) - (2)].pattern)->next = (yyvsp[(1) - (2)].pattern); (yyval.pattern) = (yyvsp[(2) - (2)].pattern); }
      break;
  
    case 118:
! #line 1028 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.pattern) = make_pattern_list ((yyvsp[(2) - (4)].word_list), (yyvsp[(4) - (4)].command)); }
      break;
  
    case 119:
! #line 1030 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.pattern) = make_pattern_list ((yyvsp[(2) - (4)].word_list), (COMMAND *)NULL); }
      break;
  
    case 120:
! #line 1032 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.pattern) = make_pattern_list ((yyvsp[(3) - (5)].word_list), (yyvsp[(5) - (5)].command)); }
      break;
  
    case 121:
! #line 1034 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.pattern) = make_pattern_list ((yyvsp[(3) - (5)].word_list), (COMMAND *)NULL); }
      break;
  
    case 122:
! #line 1038 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.pattern) = (yyvsp[(1) - (2)].pattern); }
      break;
  
    case 123:
! #line 1040 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyvsp[(2) - (3)].pattern)->next = (yyvsp[(1) - (3)].pattern); (yyval.pattern) = (yyvsp[(2) - (3)].pattern); }
      break;
  
    case 124:
! #line 1042 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyvsp[(1) - (2)].pattern)->flags |= CASEPAT_FALLTHROUGH; (yyval.pattern) = (yyvsp[(1) - (2)].pattern); }
      break;
  
    case 125:
! #line 1044 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyvsp[(2) - (3)].pattern)->flags |= CASEPAT_FALLTHROUGH; (yyvsp[(2) - (3)].pattern)->next = (yyvsp[(1) - (3)].pattern); (yyval.pattern) = (yyvsp[(2) - (3)].pattern); }
      break;
  
    case 126:
! #line 1046 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyvsp[(1) - (2)].pattern)->flags |= CASEPAT_TESTNEXT; (yyval.pattern) = (yyvsp[(1) - (2)].pattern); }
      break;
  
    case 127:
! #line 1048 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyvsp[(2) - (3)].pattern)->flags |= CASEPAT_TESTNEXT; (yyvsp[(2) - (3)].pattern)->next = (yyvsp[(1) - (3)].pattern); (yyval.pattern) = (yyvsp[(2) - (3)].pattern); }
      break;
  
    case 128:
! #line 1052 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.word_list) = make_word_list ((yyvsp[(1) - (1)].word), (WORD_LIST *)NULL); }
      break;
  
    case 129:
! #line 1054 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.word_list) = make_word_list ((yyvsp[(3) - (3)].word), (yyvsp[(1) - (3)].word_list)); }
      break;
  
    case 130:
! #line 1063 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = (yyvsp[(2) - (2)].command);
--- 2996,3110 ----
  
    case 107:
! #line 999 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = make_if_command ((yyvsp[(2) - (5)].command), (yyvsp[(4) - (5)].command), (COMMAND *)NULL); }
      break;
  
    case 108:
! #line 1001 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = make_if_command ((yyvsp[(2) - (7)].command), (yyvsp[(4) - (7)].command), (yyvsp[(6) - (7)].command)); }
      break;
  
    case 109:
! #line 1003 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = make_if_command ((yyvsp[(2) - (6)].command), (yyvsp[(4) - (6)].command), (yyvsp[(5) - (6)].command)); }
      break;
  
    case 110:
! #line 1008 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = make_group_command ((yyvsp[(2) - (3)].command)); }
      break;
  
    case 111:
! #line 1012 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = make_arith_command ((yyvsp[(1) - (1)].word_list)); }
      break;
  
    case 112:
! #line 1016 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = (yyvsp[(2) - (3)].command); }
      break;
  
    case 113:
! #line 1020 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = make_if_command ((yyvsp[(2) - (4)].command), (yyvsp[(4) - (4)].command), (COMMAND *)NULL); }
      break;
  
    case 114:
! #line 1022 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = make_if_command ((yyvsp[(2) - (6)].command), (yyvsp[(4) - (6)].command), (yyvsp[(6) - (6)].command)); }
      break;
  
    case 115:
! #line 1024 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = make_if_command ((yyvsp[(2) - (5)].command), (yyvsp[(4) - (5)].command), (yyvsp[(5) - (5)].command)); }
      break;
  
    case 117:
! #line 1029 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyvsp[(2) - (2)].pattern)->next = (yyvsp[(1) - (2)].pattern); (yyval.pattern) = (yyvsp[(2) - (2)].pattern); }
      break;
  
    case 118:
! #line 1033 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.pattern) = make_pattern_list ((yyvsp[(2) - (4)].word_list), (yyvsp[(4) - (4)].command)); }
      break;
  
    case 119:
! #line 1035 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.pattern) = make_pattern_list ((yyvsp[(2) - (4)].word_list), (COMMAND *)NULL); }
      break;
  
    case 120:
! #line 1037 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.pattern) = make_pattern_list ((yyvsp[(3) - (5)].word_list), (yyvsp[(5) - (5)].command)); }
      break;
  
    case 121:
! #line 1039 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.pattern) = make_pattern_list ((yyvsp[(3) - (5)].word_list), (COMMAND *)NULL); }
      break;
  
    case 122:
! #line 1043 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.pattern) = (yyvsp[(1) - (2)].pattern); }
      break;
  
    case 123:
! #line 1045 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyvsp[(2) - (3)].pattern)->next = (yyvsp[(1) - (3)].pattern); (yyval.pattern) = (yyvsp[(2) - (3)].pattern); }
      break;
  
    case 124:
! #line 1047 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyvsp[(1) - (2)].pattern)->flags |= CASEPAT_FALLTHROUGH; (yyval.pattern) = (yyvsp[(1) - (2)].pattern); }
      break;
  
    case 125:
! #line 1049 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyvsp[(2) - (3)].pattern)->flags |= CASEPAT_FALLTHROUGH; (yyvsp[(2) - (3)].pattern)->next = (yyvsp[(1) - (3)].pattern); (yyval.pattern) = (yyvsp[(2) - (3)].pattern); }
      break;
  
    case 126:
! #line 1051 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyvsp[(1) - (2)].pattern)->flags |= CASEPAT_TESTNEXT; (yyval.pattern) = (yyvsp[(1) - (2)].pattern); }
      break;
  
    case 127:
! #line 1053 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyvsp[(2) - (3)].pattern)->flags |= CASEPAT_TESTNEXT; (yyvsp[(2) - (3)].pattern)->next = (yyvsp[(1) - (3)].pattern); (yyval.pattern) = (yyvsp[(2) - (3)].pattern); }
      break;
  
    case 128:
! #line 1057 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.word_list) = make_word_list ((yyvsp[(1) - (1)].word), (WORD_LIST *)NULL); }
      break;
  
    case 129:
! #line 1059 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.word_list) = make_word_list ((yyvsp[(3) - (3)].word), (yyvsp[(1) - (3)].word_list)); }
      break;
  
    case 130:
! #line 1068 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = (yyvsp[(2) - (2)].command);
***************
*** 3110,3114 ****
  
    case 132:
! #line 1072 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = (yyvsp[(2) - (2)].command);
--- 3115,3119 ----
  
    case 132:
! #line 1077 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = (yyvsp[(2) - (2)].command);
***************
*** 3117,3121 ****
  
    case 134:
! #line 1079 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  if ((yyvsp[(1) - (3)].command)->type == cm_connection)
--- 3122,3126 ----
  
    case 134:
! #line 1084 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  if ((yyvsp[(1) - (3)].command)->type == cm_connection)
***************
*** 3127,3141 ****
  
    case 136:
! #line 1090 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = command_connect ((yyvsp[(1) - (4)].command), (yyvsp[(4) - (4)].command), AND_AND); }
      break;
  
    case 137:
! #line 1092 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = command_connect ((yyvsp[(1) - (4)].command), (yyvsp[(4) - (4)].command), OR_OR); }
      break;
  
    case 138:
! #line 1094 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  if ((yyvsp[(1) - (4)].command)->type == cm_connection)
--- 3132,3146 ----
  
    case 136:
! #line 1095 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = command_connect ((yyvsp[(1) - (4)].command), (yyvsp[(4) - (4)].command), AND_AND); }
      break;
  
    case 137:
! #line 1097 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = command_connect ((yyvsp[(1) - (4)].command), (yyvsp[(4) - (4)].command), OR_OR); }
      break;
  
    case 138:
! #line 1099 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  if ((yyvsp[(1) - (4)].command)->type == cm_connection)
***************
*** 3147,3181 ****
  
    case 139:
! #line 1101 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = command_connect ((yyvsp[(1) - (4)].command), (yyvsp[(4) - (4)].command), ';'); }
      break;
  
    case 140:
! #line 1103 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = command_connect ((yyvsp[(1) - (4)].command), (yyvsp[(4) - (4)].command), ';'); }
      break;
  
    case 141:
! #line 1105 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 144:
! #line 1113 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.number) = '\n'; }
      break;
  
    case 145:
! #line 1115 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.number) = ';'; }
      break;
  
    case 146:
! #line 1117 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.number) = yacc_EOF; }
      break;
  
    case 149:
! #line 1131 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = (yyvsp[(1) - (1)].command);
--- 3152,3186 ----
  
    case 139:
! #line 1106 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = command_connect ((yyvsp[(1) - (4)].command), (yyvsp[(4) - (4)].command), ';'); }
      break;
  
    case 140:
! #line 1108 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = command_connect ((yyvsp[(1) - (4)].command), (yyvsp[(4) - (4)].command), ';'); }
      break;
  
    case 141:
! #line 1110 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 144:
! #line 1118 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.number) = '\n'; }
      break;
  
    case 145:
! #line 1120 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.number) = ';'; }
      break;
  
    case 146:
! #line 1122 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.number) = yacc_EOF; }
      break;
  
    case 149:
! #line 1136 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = (yyvsp[(1) - (1)].command);
***************
*** 3193,3197 ****
  
    case 150:
! #line 1144 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  if ((yyvsp[(1) - (2)].command)->type == cm_connection)
--- 3198,3202 ----
  
    case 150:
! #line 1149 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  if ((yyvsp[(1) - (2)].command)->type == cm_connection)
***************
*** 3212,3216 ****
  
    case 151:
! #line 1160 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  (yyval.command) = (yyvsp[(1) - (2)].command);
--- 3217,3221 ----
  
    case 151:
! #line 1165 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = (yyvsp[(1) - (2)].command);
***************
*** 3228,3242 ****
  
    case 152:
! #line 1175 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = command_connect ((yyvsp[(1) - (4)].command), (yyvsp[(4) - (4)].command), AND_AND); }
      break;
  
    case 153:
! #line 1177 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = command_connect ((yyvsp[(1) - (4)].command), (yyvsp[(4) - (4)].command), OR_OR); }
      break;
  
    case 154:
! #line 1179 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  if ((yyvsp[(1) - (3)].command)->type == cm_connection)
--- 3233,3247 ----
  
    case 152:
! #line 1180 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = command_connect ((yyvsp[(1) - (4)].command), (yyvsp[(4) - (4)].command), AND_AND); }
      break;
  
    case 153:
! #line 1182 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = command_connect ((yyvsp[(1) - (4)].command), (yyvsp[(4) - (4)].command), OR_OR); }
      break;
  
    case 154:
! #line 1184 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  if ((yyvsp[(1) - (3)].command)->type == cm_connection)
***************
*** 3248,3267 ****
  
    case 155:
! #line 1186 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = command_connect ((yyvsp[(1) - (3)].command), (yyvsp[(3) - (3)].command), ';'); }
      break;
  
    case 156:
! #line 1189 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 157:
! #line 1193 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 158:
! #line 1195 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  if ((yyvsp[(2) - (2)].command))
--- 3253,3272 ----
  
    case 155:
! #line 1191 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = command_connect ((yyvsp[(1) - (3)].command), (yyvsp[(3) - (3)].command), ';'); }
      break;
  
    case 156:
! #line 1194 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 157:
! #line 1198 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 158:
! #line 1200 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  if ((yyvsp[(2) - (2)].command))
***************
*** 3272,3276 ****
  
    case 159:
! #line 1201 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  if ((yyvsp[(2) - (2)].command))
--- 3277,3281 ----
  
    case 159:
! #line 1206 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  if ((yyvsp[(2) - (2)].command))
***************
*** 3281,3285 ****
  
    case 160:
! #line 1207 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  ELEMENT x;
--- 3286,3290 ----
  
    case 160:
! #line 1212 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  ELEMENT x;
***************
*** 3301,3305 ****
  
    case 161:
! #line 1224 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  ELEMENT x;
--- 3306,3310 ----
  
    case 161:
! #line 1229 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  ELEMENT x;
***************
*** 3322,3331 ****
  
    case 162:
! #line 1244 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = command_connect ((yyvsp[(1) - (4)].command), (yyvsp[(4) - (4)].command), '|'); }
      break;
  
    case 163:
! #line 1246 "/usr/homes/chet/src/bash/src/parse.y"
      {
  			  /* Make cmd1 |& cmd2 equivalent to cmd1 2>&1 | cmd2 */
--- 3327,3336 ----
  
    case 162:
! #line 1249 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = command_connect ((yyvsp[(1) - (4)].command), (yyvsp[(4) - (4)].command), '|'); }
      break;
  
    case 163:
! #line 1251 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  /* Make cmd1 |& cmd2 equivalent to cmd1 2>&1 | cmd2 */
***************
*** 3353,3372 ****
  
    case 164:
! #line 1269 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 165:
! #line 1273 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.number) = CMD_TIME_PIPELINE; }
      break;
  
    case 166:
! #line 1275 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.number) = CMD_TIME_PIPELINE|CMD_TIME_POSIX; }
      break;
  
    case 167:
! #line 1277 "/usr/homes/chet/src/bash/src/parse.y"
      { (yyval.number) = CMD_TIME_PIPELINE|CMD_TIME_POSIX; }
      break;
--- 3358,3377 ----
  
    case 164:
! #line 1274 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.command) = (yyvsp[(1) - (1)].command); }
      break;
  
    case 165:
! #line 1278 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.number) = CMD_TIME_PIPELINE; }
      break;
  
    case 166:
! #line 1280 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.number) = CMD_TIME_PIPELINE|CMD_TIME_POSIX; }
      break;
  
    case 167:
! #line 1282 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      { (yyval.number) = CMD_TIME_PIPELINE|CMD_TIME_POSIX; }
      break;
***************
*** 3374,3378 ****
  
  /* Line 1267 of yacc.c.  */
! #line 3377 "y.tab.c"
        default: break;
      }
--- 3379,3383 ----
  
  /* Line 1267 of yacc.c.  */
! #line 3382 "y.tab.c"
        default: break;
      }
***************
*** 3588,3592 ****
  
  
! #line 1279 "/usr/homes/chet/src/bash/src/parse.y"
  
  
--- 3593,3597 ----
  
  
! #line 1284 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
  
  
***************
*** 4949,4952 ****
--- 4954,4972 ----
  static int esacs_needed_count;
  
+ static void
+ push_heredoc (r)
+      REDIRECT *r;
+ {
+   if (need_here_doc >= HEREDOC_MAX)
+     {
+       last_command_exit_value = EX_BADUSAGE;
+       need_here_doc = 0;
+       report_syntax_error (_("maximum here-document count exceeded"));
+       reset_parser ();
+       exit_shell (last_command_exit_value);
+     }
+   redir_stack[need_here_doc++] = r;
+ }
+ 
  void
  gather_here_documents ()
***************
*** 8542,8543 ****
--- 8562,8564 ----
  }
  #endif /* HANDLE_MULTIBYTE */
+ 
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 27
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 28
  
  #endif /* _PATCHLEVEL_H_ */
			     BASH PATCH REPORT
			     =================

Bash-Release:	4.3
Patch-ID:	bash43-029

Bug-Reported-by:	Michal Zalewski <lcamtuf@coredump.cx>
Bug-Reference-ID:
Bug-Reference-URL:

Bug-Description:

When bash is parsing a function definition that contains a here-document
delimited by end-of-file (or end-of-string), it leaves the closing delimiter
uninitialized.  This can result in an invalid memory access when the parsed
function is later copied.

Patch (apply with `patch -p0'):

*** ../bash-4.3.28/make_cmd.c	2011-12-16 08:08:01.000000000 -0500
--- make_cmd.c	2014-10-02 11:24:23.000000000 -0400
***************
*** 693,696 ****
--- 693,697 ----
    temp->redirector = source;
    temp->redirectee = dest_and_filename;
+   temp->here_doc_eof = 0;
    temp->instruction = instruction;
    temp->flags = 0;
*** ../bash-4.3.28/copy_cmd.c	2009-09-11 16:28:02.000000000 -0400
--- copy_cmd.c	2014-10-02 11:24:23.000000000 -0400
***************
*** 127,131 ****
      case r_reading_until:
      case r_deblank_reading_until:
!       new_redirect->here_doc_eof = savestring (redirect->here_doc_eof);
        /*FALLTHROUGH*/
      case r_reading_string:
--- 127,131 ----
      case r_reading_until:
      case r_deblank_reading_until:
!       new_redirect->here_doc_eof = redirect->here_doc_eof ? savestring (redirect->here_doc_eof) : 0;
        /*FALLTHROUGH*/
      case r_reading_string:
*** ../bash-4.3/patchlevel.h	2012-12-29 10:47:57.000000000 -0500
--- patchlevel.h	2014-03-20 20:01:28.000000000 -0400
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 28
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 29
  
  #endif /* _PATCHLEVEL_H_ */
