summaryrefslogtreecommitdiffstats
path: root/patches/source/bash/patches
diff options
context:
space:
mode:
Diffstat (limited to 'patches/source/bash/patches')
-rw-r--r--patches/source/bash/patches/bash31-001104
-rw-r--r--patches/source/bash/patches/bash31-002239
-rw-r--r--patches/source/bash/patches/bash31-00347
-rw-r--r--patches/source/bash/patches/bash31-00448
-rw-r--r--patches/source/bash/patches/bash31-00554
-rw-r--r--patches/source/bash/patches/bash31-00658
-rw-r--r--patches/source/bash/patches/bash31-007121
-rw-r--r--patches/source/bash/patches/bash31-00851
-rw-r--r--patches/source/bash/patches/bash31-00966
-rw-r--r--patches/source/bash/patches/bash31-01054
-rw-r--r--patches/source/bash/patches/bash31-01147
-rw-r--r--patches/source/bash/patches/bash31-01247
-rw-r--r--patches/source/bash/patches/bash31-01344
-rw-r--r--patches/source/bash/patches/bash31-014105
-rw-r--r--patches/source/bash/patches/bash31-015106
-rw-r--r--patches/source/bash/patches/bash31-01651
-rw-r--r--patches/source/bash/patches/bash31-017131
-rw-r--r--patches/source/bash/patches/bash31-018104
-rw-r--r--patches/source/bash/patches/bash31-01943
-rw-r--r--patches/source/bash/patches/bash31-020217
-rw-r--r--patches/source/bash/patches/bash31-021147
-rw-r--r--patches/source/bash/patches/bash31-02259
-rw-r--r--patches/source/bash/patches/bash31-023125
23 files changed, 2068 insertions, 0 deletions
diff --git a/patches/source/bash/patches/bash31-001 b/patches/source/bash/patches/bash31-001
new file mode 100644
index 000000000..4a10a02c1
--- /dev/null
+++ b/patches/source/bash/patches/bash31-001
@@ -0,0 +1,104 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-001
+
+Bug-Reported-by: Mike Frysinger <vapier@gentoo.org>
+Bug-Reference-ID: <20051212015924.GA820@toucan.gentoo.org> <20051214034438.GK1863@toucan.gentoo.org>
+Bug-Reference-URL: http://lists.gnu.org/archive/html/bug-bash/2005-12/msg00030.html http://lists.gnu.org/archive/html/bug-bash/2005-12/msg00041.html
+
+Bug-Description:
+
+There are parsing problems with compound assignments in several contexts,
+including as arguments to builtins like `local', `eval', and `let', and
+as multiple assignments in a single command.
+
+Patch:
+
+*** ../bash-3.1/parse.y Fri Nov 11 23:14:18 2005
+--- parse.y Fri Dec 16 20:43:07 2005
+***************
+*** 3696,3700 ****
+ b = builtin_address_internal (token, 0);
+ if (b && (b->flags & ASSIGNMENT_BUILTIN))
+! parser_state |= PST_ASSIGNOK;
+ }
+
+--- 3696,3702 ----
+ b = builtin_address_internal (token, 0);
+ if (b && (b->flags & ASSIGNMENT_BUILTIN))
+! parser_state |= PST_ASSIGNOK;
+! else if (STREQ (token, "eval") || STREQ (token, "let"))
+! parser_state |= PST_ASSIGNOK;
+ }
+
+***************
+*** 4687,4691 ****
+ {
+ WORD_LIST *wl, *rl;
+! int tok, orig_line_number, orig_token_size;
+ char *saved_token, *ret;
+
+--- 4689,4693 ----
+ {
+ WORD_LIST *wl, *rl;
+! int tok, orig_line_number, orig_token_size, orig_last_token, assignok;
+ char *saved_token, *ret;
+
+***************
+*** 4693,4696 ****
+--- 4695,4699 ----
+ orig_token_size = token_buffer_size;
+ orig_line_number = line_number;
++ orig_last_token = last_read_token;
+
+ last_read_token = WORD; /* WORD to allow reserved words here */
+***************
+*** 4699,4702 ****
+--- 4702,4707 ----
+ token_buffer_size = 0;
+
++ assignok = parser_state&PST_ASSIGNOK; /* XXX */
++
+ wl = (WORD_LIST *)NULL; /* ( */
+ parser_state |= PST_COMPASSIGN;
+***************
+*** 4741,4745 ****
+ }
+
+! last_read_token = WORD;
+ if (wl)
+ {
+--- 4746,4750 ----
+ }
+
+! last_read_token = orig_last_token; /* XXX - was WORD? */
+ if (wl)
+ {
+***************
+*** 4753,4756 ****
+--- 4758,4765 ----
+ if (retlenp)
+ *retlenp = (ret && *ret) ? strlen (ret) : 0;
++
++ if (assignok)
++ parser_state |= PST_ASSIGNOK;
++
+ return ret;
+ }
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 0
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 1
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/patches/source/bash/patches/bash31-002 b/patches/source/bash/patches/bash31-002
new file mode 100644
index 000000000..fac9a99af
--- /dev/null
+++ b/patches/source/bash/patches/bash31-002
@@ -0,0 +1,239 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-002
+
+Bug-Reported-by: vapier@gentoo.org
+Bug-Reference-ID: <20051210223218.GD3324@toucan.gentoo.org>
+Bug-Reference-URL:http://lists.gnu.org/archive/html/bug-bash/2005-12/msg00021.html
+
+Bug-Description:
+
+This corrects several omissions in the bash documentation: It adds the new
+options to `ulimit', the exact expansions for `case' patterns, clarification
+of the language concerning the return value of `[[', and updated version
+information.
+
+Patch:
+
+*** ../bash-3.1/doc/bash.1 Wed Oct 12 11:40:52 2005
+--- doc/bash.1 Wed Dec 28 19:58:54 2005
+***************
+*** 7,16 ****
+ .\" chet@po.cwru.edu
+ .\"
+! .\" Last Change: Sat Aug 27 13:28:44 EDT 2005
+ .\"
+ .\" bash_builtins, strip all but Built-Ins section
+ .if \n(zZ=1 .ig zZ
+ .if \n(zY=1 .ig zY
+! .TH BASH 1 "2005 Aug 27" "GNU Bash-3.1-beta1"
+ .\"
+ .\" There's some problem with having a `@'
+--- 7,16 ----
+ .\" chet@po.cwru.edu
+ .\"
+! .\" Last Change: Wed Dec 28 19:58:45 EST 2005
+ .\"
+ .\" bash_builtins, strip all but Built-Ins section
+ .if \n(zZ=1 .ig zZ
+ .if \n(zY=1 .ig zY
+! .TH BASH 1 "2005 Dec 28" "GNU Bash-3.1"
+ .\"
+ .\" There's some problem with having a `@'
+***************
+*** 678,683 ****
+ is enabled, the match is performed without regard to the case
+ of alphabetic characters.
+! The return value is 0 if the string matches or does not match
+! the pattern, respectively, and 1 otherwise.
+ Any part of the pattern may be quoted to force it to be matched as a
+ string.
+--- 678,683 ----
+ is enabled, the match is performed without regard to the case
+ of alphabetic characters.
+! The return value is 0 if the string matches (\fB==\fP) or does not match
+! (\fB!=\fP) the pattern, and 1 otherwise.
+ Any part of the pattern may be quoted to force it to be matched as a
+ string.
+***************
+*** 808,811 ****
+--- 808,817 ----
+ .B Pathname Expansion
+ below).
++ The \fIword\fP is expanded using tilde
++ expansion, parameter and variable expansion, arithmetic substituion,
++ command substitution, process substitution and quote removal.
++ Each \fIpattern\fP examined is expanded using tilde
++ expansion, parameter and variable expansion, arithmetic substituion,
++ command substitution, and process substitution.
+ If the shell option
+ .B nocasematch
+***************
+*** 8485,8489 ****
+ none are found.
+ .TP
+! \fBulimit\fP [\fB\-SHacdflmnpstuv\fP [\fIlimit\fP]]
+ Provides control over the resources available to the shell and to
+ processes started by it, on systems that allow such control.
+--- 8485,8489 ----
+ none are found.
+ .TP
+! \fBulimit\fP [\fB\-SHacdfilmnpqstuvx\fP [\fIlimit\fP]]
+ Provides control over the resources available to the shell and to
+ processes started by it, on systems that allow such control.
+***************
+*** 8524,8527 ****
+--- 8524,8530 ----
+ The maximum size of files created by the shell
+ .TP
++ .B \-i
++ The maximum number of pending signals
++ .TP
+ .B \-l
+ The maximum size that may be locked into memory
+***************
+*** 8537,8540 ****
+--- 8540,8546 ----
+ The pipe size in 512-byte blocks (this may not be set)
+ .TP
++ .B \-q
++ The maximum number of bytes in POSIX message queues
++ .TP
+ .B \-s
+ The maximum stack size
+***************
+*** 8548,8551 ****
+--- 8554,8560 ----
+ .B \-v
+ The maximum amount of virtual memory available to the shell
++ .TP
++ .B \-x
++ The maximum number of file locks
+ .PD
+ .PP
+*** ../bash-3.1/doc/bashref.texi Mon Oct 3 15:07:21 2005
+--- doc/bashref.texi Fri Dec 30 10:50:39 2005
+***************
+*** 962,967 ****
+ is enabled, the match is performed without regard to the case
+ of alphabetic characters.
+! The return value is 0 if the string matches or does not match
+! the pattern, respectively, and 1 otherwise.
+ Any part of the pattern may be quoted to force it to be matched as a
+ string.
+--- 962,967 ----
+ is enabled, the match is performed without regard to the case
+ of alphabetic characters.
+! The return value is 0 if the string matches (@samp{==}) or does not
+! match (@samp{!=})the pattern, and 1 otherwise.
+ Any part of the pattern may be quoted to force it to be matched as a
+ string.
+***************
+*** 2599,2603 ****
+ or inconvenient to obtain with separate utilities.
+
+! This section briefly the builtins which Bash inherits from
+ the Bourne Shell, as well as the builtin commands which are unique
+ to or have been extended in Bash.
+--- 2597,2601 ----
+ or inconvenient to obtain with separate utilities.
+
+! This section briefly describes the builtins which Bash inherits from
+ the Bourne Shell, as well as the builtin commands which are unique
+ to or have been extended in Bash.
+***************
+*** 3834,3838 ****
+ @btindex ulimit
+ @example
+! ulimit [-acdflmnpstuvSH] [@var{limit}]
+ @end example
+ @code{ulimit} provides control over the resources available to processes
+--- 3834,3838 ----
+ @btindex ulimit
+ @example
+! ulimit [-acdfilmnpqstuvxSH] [@var{limit}]
+ @end example
+ @code{ulimit} provides control over the resources available to processes
+***************
+*** 3858,3861 ****
+--- 3858,3864 ----
+ The maximum size of files created by the shell.
+
++ @item -i
++ The maximum number of pending signals.
++
+ @item -l
+ The maximum size that may be locked into memory.
+***************
+*** 3870,3873 ****
+--- 3873,3879 ----
+ The pipe buffer size.
+
++ @item -q
++ The maximum number of bytes in POSIX message queues.
++
+ @item -s
+ The maximum stack size.
+***************
+*** 3882,3885 ****
+--- 3888,3894 ----
+ The maximum amount of virtual memory available to the process.
+
++ @item -x
++ The maximum number of file locks.
++
+ @end table
+
+***************
+*** 4090,4095 ****
+
+ @item -x
+! Print a trace of simple commands, \fBfor\fP commands, \fBcase\fP
+! commands, \fBselect\fP commands, and arithmetic \fBfor\fP commands
+ and their arguments or associated word lists after they are
+ expanded and before they are executed. The value of the @env{PS4}
+--- 4103,4108 ----
+
+ @item -x
+! Print a trace of simple commands, @code{for} commands, @code{case}
+! commands, @code{select} commands, and arithmetic @code{for} commands
+ and their arguments or associated word lists after they are
+ expanded and before they are executed. The value of the @env{PS4}
+*** ../bash-3.1/doc/version.texi Tue Sep 20 14:52:56 2005
+--- doc/version.texi Fri Dec 30 10:50:58 2005
+***************
+*** 3,10 ****
+ @end ignore
+
+! @set LASTCHANGE Mon Sep 5 11:47:04 EDT 2005
+
+! @set EDITION 3.1-beta1
+! @set VERSION 3.1-beta1
+! @set UPDATED 5 September 2005
+! @set UPDATED-MONTH September 2005
+--- 3,10 ----
+ @end ignore
+
+! @set LASTCHANGE Fri Dec 30 10:50:51 EST 2005
+
+! @set EDITION 3.1
+! @set VERSION 3.1
+! @set UPDATED 30 December 2005
+! @set UPDATED-MONTH December 2005
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 1
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 2
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/patches/source/bash/patches/bash31-003 b/patches/source/bash/patches/bash31-003
new file mode 100644
index 000000000..cd36dc83e
--- /dev/null
+++ b/patches/source/bash/patches/bash31-003
@@ -0,0 +1,47 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-003
+
+Bug-Reported-by: Adam Buraczewski <adamb@nor.pl>
+Bug-Reference-ID: <200512210950.jBL9o4C2008608@localhost.localdomain>
+Bug-Reference-URL: http://lists.gnu.org/archive/html/bug-bash/2005-12/msg00055.html
+
+Bug-Description:
+
+A missing #define guard causes bash to not compile when readline is not
+configured in, either as the result of explicit disabling or when the
+`--enable-minimal-config' option is given to configure.
+
+Patch:
+
+*** ../bash-3.1/variables.c Sat Nov 12 21:22:37 2005
+--- variables.c Mon Dec 26 13:34:03 2005
+***************
+*** 861,867 ****
+--- 863,871 ----
+ char val[INT_STRLEN_BOUND(int) + 1], *v;
+
++ #if defined (READLINE)
+ /* If we are currently assigning to LINES or COLUMNS, don't do anything. */
+ if (winsize_assignment)
+ return;
++ #endif
+
+ v = inttostr (lines, val, sizeof (val));
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 2
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 3
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/patches/source/bash/patches/bash31-004 b/patches/source/bash/patches/bash31-004
new file mode 100644
index 000000000..4f9d578ef
--- /dev/null
+++ b/patches/source/bash/patches/bash31-004
@@ -0,0 +1,48 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-004
+
+Bug-Reported-by: Mike Frysinger <vapier@gentoo.org>
+Bug-Reference-ID: <20051223172359.GF14579@toucan.gentoo.org>
+Bug-Reference-URL: http://lists.gnu.org/archive/html/bug-bash/2005-12/msg00062.html
+
+Bug-Description:
+
+A local array variable declared at function scope that shadows a variable
+of the same name declared in a previous scope did not create a separate
+variable instance, but used the previous one.
+
+Patch:
+
+*** ../bash-3.1/subst.c Mon Oct 24 09:51:13 2005
+--- subst.c Fri Dec 30 12:11:53 2005
+***************
+*** 2188,2192 ****
+ {
+ v = find_variable (name);
+! if (v == 0 || array_p (v) == 0)
+ v = make_local_array_variable (name);
+ v = assign_array_var_from_string (v, value, flags);
+--- 2188,2192 ----
+ {
+ v = find_variable (name);
+! if (v == 0 || array_p (v) == 0 || v->context != variable_context)
+ v = make_local_array_variable (name);
+ v = assign_array_var_from_string (v, value, flags);
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 3
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 4
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/patches/source/bash/patches/bash31-005 b/patches/source/bash/patches/bash31-005
new file mode 100644
index 000000000..b6d5cdca8
--- /dev/null
+++ b/patches/source/bash/patches/bash31-005
@@ -0,0 +1,54 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-005
+
+Bug-Reported-by:
+Bug-Reference-ID:
+Bug-Reference-URL:
+
+Bug-Description:
+
+When tilde expansion fails, POSIX leaves it unspecified whether or not the
+word undergoes the additional word expansions. Bash-3.1 as distributed
+skipped the rest of the expansions; this patch restores the bash-3.0 behavior.
+
+This means that something like
+ USER=ratbert
+ echo ~$USER
+
+will echo `~ratbert' rather than `~$USER'.
+
+Patch:
+
+*** ../bash-3.1/subst.c Mon Oct 24 09:51:13 2005
+--- subst.c Fri Dec 30 12:11:53 2005
+***************
+*** 6796,6799 ****
+--- 6823,6832 ----
+ {
+ temp1 = bash_tilde_expand (temp, tflag);
++ if (temp1 && *temp1 == '~' && STREQ (temp, temp1))
++ {
++ FREE (temp);
++ FREE (temp1);
++ goto add_character; /* tilde expansion failed */
++ }
+ free (temp);
+ temp = temp1;
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 4
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 5
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/patches/source/bash/patches/bash31-006 b/patches/source/bash/patches/bash31-006
new file mode 100644
index 000000000..8d7499381
--- /dev/null
+++ b/patches/source/bash/patches/bash31-006
@@ -0,0 +1,58 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-006
+
+Bug-Reported-by: Mike Frysinger <vapier@gentoo.org>
+Bug-Reference-ID: <200601120613.11907.vapier@gentoo.org>
+Bug-Reference-URL: http://lists.gnu.org/archive/html/bug-bash/2006-01/msg00045.html
+
+Bug-Description:
+
+Under some circumstances, Bash can use an incorrect setting for the flag
+that indicates whether or not the terminal can auto-wrap, resulting in line-
+wrapping errors.
+
+Patch:
+
+*** ../bash-3.1/lib/readline/terminal.c Sat Nov 12 20:46:54 2005
+--- lib/readline/terminal.c Tue Jan 31 10:57:54 2006
+***************
+*** 123,127 ****
+
+ /* Non-zero means the terminal can auto-wrap lines. */
+! int _rl_term_autowrap;
+
+ /* Non-zero means that this terminal has a meta key. */
+--- 126,130 ----
+
+ /* Non-zero means the terminal can auto-wrap lines. */
+! int _rl_term_autowrap = -1;
+
+ /* Non-zero means that this terminal has a meta key. */
+***************
+*** 275,278 ****
+--- 278,284 ----
+ int rows, cols;
+ {
++ if (_rl_term_autowrap == -1)
++ _rl_init_terminal_io (rl_terminal_name);
++
+ if (rows > 0)
+ _rl_screenheight = rows;
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 5
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 6
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/patches/source/bash/patches/bash31-007 b/patches/source/bash/patches/bash31-007
new file mode 100644
index 000000000..6233786c4
--- /dev/null
+++ b/patches/source/bash/patches/bash31-007
@@ -0,0 +1,121 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-007
+
+Bug-Reported-by: Tim Waugh <twaugh@redhat.com>, Laird Breyer <laird@lbreyer.com>
+Bug-Reference-ID: <20060105174434.GY16000@redhat.com>
+Bug-Reference-URL: http://lists.gnu.org/archive/html/bug-bash/2006-01/msg00009.html
+ http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=347695
+
+Bug-Description:
+
+When the number of saved jobs exceeds the initial size of the jobs array
+(4096 slots), the array must be compacted and reallocated. An error in
+the code to do that could cause a segmentation fault.
+
+Patch:
+
+*** ../bash-3.1/jobs.c Fri Nov 11 23:13:27 2005
+--- jobs.c Wed Feb 1 13:55:38 2006
+***************
+*** 845,851 ****
+ {
+ sigset_t set, oset;
+! int nsize, i, j;
+ JOB **nlist;
+
+ nsize = ((js.j_njobs + JOB_SLOTS - 1) / JOB_SLOTS);
+ nsize *= JOB_SLOTS;
+--- 888,895 ----
+ {
+ sigset_t set, oset;
+! int nsize, i, j, ncur, nprev;
+ JOB **nlist;
+
++ ncur = nprev = NO_JOB;
+ nsize = ((js.j_njobs + JOB_SLOTS - 1) / JOB_SLOTS);
+ nsize *= JOB_SLOTS;
+***************
+*** 855,869 ****
+
+ BLOCK_CHILD (set, oset);
+! nlist = (JOB **) xmalloc (nsize * sizeof (JOB *));
+ for (i = j = 0; i < js.j_jobslots; i++)
+ if (jobs[i])
+! nlist[j++] = jobs[i];
+
+ js.j_firstj = 0;
+! js.j_lastj = (j > 0) ? j - 1: 0;
+ js.j_jobslots = nsize;
+
+! free (jobs);
+! jobs = nlist;
+
+ UNBLOCK_CHILD (oset);
+--- 899,947 ----
+
+ BLOCK_CHILD (set, oset);
+! nlist = (js.j_jobslots == nsize) ? jobs : (JOB **) xmalloc (nsize * sizeof (JOB *));
+!
+ for (i = j = 0; i < js.j_jobslots; i++)
+ if (jobs[i])
+! {
+! if (i == js.j_current)
+! ncur = j;
+! if (i == js.j_previous)
+! nprev = j;
+! nlist[j++] = jobs[i];
+! }
+!
+! #if defined (DEBUG)
+! itrace ("realloc_jobs_list: resize jobs list from %d to %d", js.j_jobslots, nsize);
+! itrace ("realloc_jobs_list: j_lastj changed from %d to %d", js.j_lastj, (j > 0) ? j - 1 : 0);
+! itrace ("realloc_jobs_list: j_njobs changed from %d to %d", js.j_njobs, (j > 0) ? j - 1 : 0);
+! #endif
+
+ js.j_firstj = 0;
+! js.j_lastj = (j > 0) ? j - 1 : 0;
+! js.j_njobs = j;
+ js.j_jobslots = nsize;
+
+! /* Zero out remaining slots in new jobs list */
+! for ( ; j < nsize; j++)
+! nlist[j] = (JOB *)NULL;
+!
+! if (jobs != nlist)
+! {
+! free (jobs);
+! jobs = nlist;
+! }
+!
+! if (ncur != NO_JOB)
+! js.j_current = ncur;
+! if (nprev != NO_JOB)
+! js.j_previous = nprev;
+!
+! /* Need to reset these */
+! if (js.j_current == NO_JOB || js.j_previous == NO_JOB || js.j_current > js.j_lastj || js.j_previous > js.j_lastj)
+! reset_current ();
+!
+! #ifdef DEBUG
+! itrace ("realloc_jobs_list: reset js.j_current (%d) and js.j_previous (%d)", js.j_current, js.j_previous);
+! #endif
+
+ UNBLOCK_CHILD (oset);
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 6
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 7
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/patches/source/bash/patches/bash31-008 b/patches/source/bash/patches/bash31-008
new file mode 100644
index 000000000..3427b64e0
--- /dev/null
+++ b/patches/source/bash/patches/bash31-008
@@ -0,0 +1,51 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-008
+
+Bug-Reported-by: Ingemar Nilsson <init@kth.se>
+Bug-Reference-ID: <43C38D35.7020404@kth.se>
+Bug-Reference-URL: http://lists.gnu.org/archive/html/bug-bash/2006-01/msg00044.html
+
+Bug-Description:
+
+In some cases, bash inappropriately allows SIGINT from the terminal to
+reach background processes.
+
+Patch:
+
+*** ../bash-3.1/jobs.c Fri Nov 11 23:13:27 2005
+--- jobs.c Wed Feb 1 13:55:38 2006
+***************
+*** 2199,2203 ****
+ wait_sigint_received = 0;
+ if (job_control == 0)
+! old_sigint_handler = set_signal_handler (SIGINT, wait_sigint_handler);
+
+ termination_state = last_command_exit_value;
+--- 2298,2306 ----
+ wait_sigint_received = 0;
+ if (job_control == 0)
+! {
+! old_sigint_handler = set_signal_handler (SIGINT, wait_sigint_handler);
+! if (old_sigint_handler == SIG_IGN)
+! set_signal_handler (SIGINT, old_sigint_handler);
+! }
+
+ termination_state = last_command_exit_value;
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 7
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 8
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/patches/source/bash/patches/bash31-009 b/patches/source/bash/patches/bash31-009
new file mode 100644
index 000000000..8ef229585
--- /dev/null
+++ b/patches/source/bash/patches/bash31-009
@@ -0,0 +1,66 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-009
+
+Bug-Reported-by: Joshua Neuheisel <jneuheisel@gmail.com>
+Bug-Reference-ID: <25d873330601140820v4ad8efd2t8bf683b073c138b3@mail.gmail.com>
+Bug-Reference-URL: http://lists.gnu.org/archive/html/bug-bash/2006-01/msg00062.html
+
+Bug-Description:
+
+Under some circumstances, background (asynchronous) jobs can set the terminal
+process group incorrectly. This can cause a foreground process (including
+the foreground shell) to get read errors and exit.
+
+Patch:
+
+*** ../bash-3.1/jobs.c Fri Nov 11 23:13:27 2005
+--- jobs.c Wed Feb 1 13:55:38 2006
+***************
+*** 620,625 ****
+ * the parent gives it away.
+ *
+ */
+! if (job_control && newjob->pgrp)
+ give_terminal_to (newjob->pgrp, 0);
+ }
+--- 634,642 ----
+ * the parent gives it away.
+ *
++ * Don't give the terminal away if this shell is an asynchronous
++ * subshell.
++ *
+ */
+! if (job_control && newjob->pgrp && (subshell_environment&SUBSHELL_ASYNC) == 0)
+ give_terminal_to (newjob->pgrp, 0);
+ }
+***************
+*** 1656,1660 ****
+ shell's process group (we could be in the middle of a
+ pipeline, for example). */
+! if (async_p == 0 && pipeline_pgrp != shell_pgrp)
+ give_terminal_to (pipeline_pgrp, 0);
+
+--- 1743,1747 ----
+ shell's process group (we could be in the middle of a
+ pipeline, for example). */
+! if (async_p == 0 && pipeline_pgrp != shell_pgrp && ((subshell_environment&SUBSHELL_ASYNC) == 0))
+ give_terminal_to (pipeline_pgrp, 0);
+
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 8
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 9
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/patches/source/bash/patches/bash31-010 b/patches/source/bash/patches/bash31-010
new file mode 100644
index 000000000..066a3242d
--- /dev/null
+++ b/patches/source/bash/patches/bash31-010
@@ -0,0 +1,54 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-010
+
+Bug-Reported-by: vw@vonwolff.de
+Bug-Reference-ID: <20060123135234.1AC2F1D596@wst07.vonwolff.de>
+Bug-Reference-URL: http://lists.gnu.org/archive/html/bug-bash/2006-01/msg00090.html
+
+Bug-Description:
+
+There is a difference in behavior between bash-3.0 and bash-3.1 involving
+parsing of single- and double-quoted strings occurring in old-style
+command substitution. The difference has to do with how backslashes are
+processed. This patch restores a measure of backwards compatibility while
+the question of POSIX conformance and ultimately correct behavior is discussed.
+
+Patch:
+
+*** ../bash-3.1/parse.y Fri Nov 11 23:14:18 2005
+--- parse.y Wed Jan 25 14:55:18 2006
+***************
+*** 2899,2903 ****
+ else if MBTEST(qc == '`' && (ch == '"' || ch == '\'') && in_comment == 0)
+ {
+! nestret = parse_matched_pair (0, ch, ch, &nestlen, rflags);
+ goto add_nestret;
+ }
+--- 2901,2909 ----
+ else if MBTEST(qc == '`' && (ch == '"' || ch == '\'') && in_comment == 0)
+ {
+! /* Add P_ALLOWESC so backslash quotes the next character and
+! shell_getc does the right thing with \<newline>. We do this for
+! a measure of backwards compatibility -- it's not strictly the
+! right POSIX thing. */
+! nestret = parse_matched_pair (0, ch, ch, &nestlen, rflags|P_ALLOWESC);
+ goto add_nestret;
+ }
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 9
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 10
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/patches/source/bash/patches/bash31-011 b/patches/source/bash/patches/bash31-011
new file mode 100644
index 000000000..025b83907
--- /dev/null
+++ b/patches/source/bash/patches/bash31-011
@@ -0,0 +1,47 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-011
+
+Bug-Reported-by: Mike Stroyan <mike.stroyan@hp.com>
+Bug-Reference-ID: <E1EvwxP-0004LD-GC@localhost.localdomain>
+Bug-Reference-URL: http://lists.gnu.org/archive/html/bug-bash/2006-01/msg00033.html
+
+Bug-Description:
+
+A change in bash-3.1 caused the single quotes to be stripped from ANSI-C
+quoting inside double-quoted command substitutions.
+
+Patch:
+
+*** ../bash-3.1/parse.y Fri Nov 11 23:14:18 2005
+--- parse.y Wed Jan 25 14:55:18 2006
+***************
+*** 2908,2912 ****
+ count--;
+ if (ch == '(') /* ) */
+! nestret = parse_matched_pair (0, '(', ')', &nestlen, rflags);
+ else if (ch == '{') /* } */
+ nestret = parse_matched_pair (0, '{', '}', &nestlen, P_FIRSTCLOSE|rflags);
+--- 2914,2918 ----
+ count--;
+ if (ch == '(') /* ) */
+! nestret = parse_matched_pair (0, '(', ')', &nestlen, rflags & ~P_DQUOTE);
+ else if (ch == '{') /* } */
+ nestret = parse_matched_pair (0, '{', '}', &nestlen, P_FIRSTCLOSE|rflags);
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 10
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 11
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/patches/source/bash/patches/bash31-012 b/patches/source/bash/patches/bash31-012
new file mode 100644
index 000000000..b0ddb3a48
--- /dev/null
+++ b/patches/source/bash/patches/bash31-012
@@ -0,0 +1,47 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-012
+
+Bug-Reported-by: Alexander Kshevetskiy <alex@dgap.mipt.ru>
+Bug-Reference-ID: <308374997.20060124175849@dgap.mipt.ru>
+Bug-Reference-URL: http://lists.gnu.org/archive/html/bug-bash/2006-01/msg00097.html
+
+Bug-Description:
+
+There is a parsing problem involving parentheses in assignment statements
+that causes words to be terminated prematurely.
+
+Patch:
+
+*** ../bash-3.1/parse.y Fri Nov 11 23:14:18 2005
+--- parse.y Wed Jan 25 14:55:18 2006
+***************
+*** 3579,3583 ****
+ all_digit_token = 0;
+ compound_assignment = 1;
+! #if 0
+ goto next_character;
+ #else
+--- 3584,3588 ----
+ all_digit_token = 0;
+ compound_assignment = 1;
+! #if 1
+ goto next_character;
+ #else
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 11
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 12
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/patches/source/bash/patches/bash31-013 b/patches/source/bash/patches/bash31-013
new file mode 100644
index 000000000..93c7c8fc8
--- /dev/null
+++ b/patches/source/bash/patches/bash31-013
@@ -0,0 +1,44 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-013
+
+Bug-Reported-by: Bob Rossi <bob@brasko.net>
+Bug-Reference-ID: <43F60606.80708@case.edu>
+Bug-Reference-URL:
+
+Bug-Description:
+
+In some cases, readline will reference freed memory when attempting to
+display a portion of the prompt.
+
+Patch:
+
+*** ../bash-3.1-patched/lib/readline/readline.c Mon Jul 4 22:29:35 2005
+--- lib/readline/readline.c Fri Feb 17 22:54:22 2006
+***************
+*** 282,287 ****
+--- 282,288 ----
+ {
+ FREE (rl_prompt);
+ rl_prompt = prompt ? savestring (prompt) : (char *)NULL;
++ rl_display_prompt = rl_prompt ? rl_prompt : "";
+
+ rl_visible_prompt_length = rl_expand_prompt (rl_prompt);
+ return 0;
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 12
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 13
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/patches/source/bash/patches/bash31-014 b/patches/source/bash/patches/bash31-014
new file mode 100644
index 000000000..82ff9b408
--- /dev/null
+++ b/patches/source/bash/patches/bash31-014
@@ -0,0 +1,105 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-014
+
+Bug-Reported-by: Mike Stroyan <mike.stroyan@hp.com>
+Bug-Reference-ID: <20060203191607.GC27614@localhost>
+Bug-Reference-URL: http://lists.gnu.org/archive/html/bug-bash/2006-02/msg00004.html
+
+Bug-Description:
+
+The displayed search prompt is corrupted when using non-incremental
+searches in vi and emacs mode if the prompt contains non-printing
+characters or spans multiple lines. The prompt is expanded more than
+once; the second time without the escape sequences that protect non-
+printing characters from the length calculations.
+
+Patch:
+
+*** ../bash-3.1-patched/lib/readline/display.c Wed Nov 30 14:05:02 2005
+--- lib/readline/display.c Sat Feb 18 12:14:58 2006
+***************
+*** 1983,1993 ****
+ int pchar;
+ {
+ int len;
+! char *pmt;
+
+ rl_save_prompt ();
+
+! if (saved_local_prompt == 0)
+ {
+ len = (rl_prompt && *rl_prompt) ? strlen (rl_prompt) : 0;
+ pmt = (char *)xmalloc (len + 2);
+--- 1998,2012 ----
+ int pchar;
+ {
+ int len;
+! char *pmt, *p;
+
+ rl_save_prompt ();
+
+! /* We've saved the prompt, and can do anything with the various prompt
+! strings we need before they're restored. We want the unexpanded
+! portion of the prompt string after any final newline. */
+! p = rl_prompt ? strrchr (rl_prompt, '\n') : 0;
+! if (p == 0)
+ {
+ len = (rl_prompt && *rl_prompt) ? strlen (rl_prompt) : 0;
+ pmt = (char *)xmalloc (len + 2);
+***************
+*** 1998,2016 ****
+ }
+ else
+ {
+! len = *saved_local_prompt ? strlen (saved_local_prompt) : 0;
+ pmt = (char *)xmalloc (len + 2);
+ if (len)
+! strcpy (pmt, saved_local_prompt);
+ pmt[len] = pchar;
+ pmt[len+1] = '\0';
+! local_prompt = savestring (pmt);
+! prompt_last_invisible = saved_last_invisible;
+! prompt_visible_length = saved_visible_length + 1;
+! }
+
+ prompt_physical_chars = saved_physical_chars + 1;
+-
+ return pmt;
+ }
+
+--- 2017,2033 ----
+ }
+ else
+ {
+! p++;
+! len = strlen (p);
+ pmt = (char *)xmalloc (len + 2);
+ if (len)
+! strcpy (pmt, p);
+ pmt[len] = pchar;
+ pmt[len+1] = '\0';
+! }
+
++ /* will be overwritten by expand_prompt, called from rl_message */
+ prompt_physical_chars = saved_physical_chars + 1;
+ return pmt;
+ }
+
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 13
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 14
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/patches/source/bash/patches/bash31-015 b/patches/source/bash/patches/bash31-015
new file mode 100644
index 000000000..deb9eed58
--- /dev/null
+++ b/patches/source/bash/patches/bash31-015
@@ -0,0 +1,106 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-015
+
+Bug-Reported-by: Benoit Vila
+Bug-Reference-ID: <43FCA614.1090108@free.fr>
+Bug-Reference-URL: http://lists.gnu.org/archive/html/bug-bash/2006-02/msg00058.html
+
+Bug-Description:
+
+A problem with the extended globbing code prevented dots from matching
+filenames when used in some extended matching patterns.
+
+Patch:
+
+*** ../bash-3.1-patched/lib/glob/sm_loop.c Sun Oct 16 21:21:04 2005
+--- lib/glob/sm_loop.c Mon Feb 27 17:18:43 2006
+***************
+*** 639,643 ****
+ CHAR *pnext; /* pointer to next sub-pattern */
+ CHAR *srest; /* pointer to rest of string */
+! int m1, m2;
+
+ #if DEBUG_MATCHING
+--- 638,642 ----
+ CHAR *pnext; /* pointer to next sub-pattern */
+ CHAR *srest; /* pointer to rest of string */
+! int m1, m2, xflags; /* xflags = flags passed to recursive matches */
+
+ #if DEBUG_MATCHING
+***************
+*** 645,648 ****
+--- 644,648 ----
+ fprintf(stderr, "extmatch: s = %s; se = %s\n", s, se);
+ fprintf(stderr, "extmatch: p = %s; pe = %s\n", p, pe);
++ fprintf(stderr, "extmatch: flags = %d\n", flags);
+ #endif
+
+***************
+*** 678,683 ****
+ multiple matches of the pattern. */
+ if (m1)
+! m2 = (GMATCH (srest, se, prest, pe, flags) == 0) ||
+! (s != srest && GMATCH (srest, se, p - 1, pe, flags) == 0);
+ if (m1 && m2)
+ return (0);
+--- 678,687 ----
+ multiple matches of the pattern. */
+ if (m1)
+! {
+! /* if srest > s, we are not at start of string */
+! xflags = (srest > s) ? (flags & ~FNM_PERIOD) : flags;
+! m2 = (GMATCH (srest, se, prest, pe, xflags) == 0) ||
+! (s != srest && GMATCH (srest, se, p - 1, pe, xflags) == 0);
+! }
+ if (m1 && m2)
+ return (0);
+***************
+*** 705,710 ****
+ for ( ; srest <= se; srest++)
+ {
+ if (GMATCH (s, srest, psub, pnext - 1, flags) == 0 &&
+! GMATCH (srest, se, prest, pe, flags) == 0)
+ return (0);
+ }
+--- 709,716 ----
+ for ( ; srest <= se; srest++)
+ {
++ /* if srest > s, we are not at start of string */
++ xflags = (srest > s) ? (flags & ~FNM_PERIOD) : flags;
+ if (GMATCH (s, srest, psub, pnext - 1, flags) == 0 &&
+! GMATCH (srest, se, prest, pe, xflags) == 0)
+ return (0);
+ }
+***************
+*** 727,731 ****
+ break;
+ }
+! if (m1 == 0 && GMATCH (srest, se, prest, pe, flags) == 0)
+ return (0);
+ }
+--- 733,739 ----
+ break;
+ }
+! /* if srest > s, we are not at start of string */
+! xflags = (srest > s) ? (flags & ~FNM_PERIOD) : flags;
+! if (m1 == 0 && GMATCH (srest, se, prest, pe, xflags) == 0)
+ return (0);
+ }
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 14
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 15
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/patches/source/bash/patches/bash31-016 b/patches/source/bash/patches/bash31-016
new file mode 100644
index 000000000..fa0ffe1c7
--- /dev/null
+++ b/patches/source/bash/patches/bash31-016
@@ -0,0 +1,51 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-016
+
+Bug-Reported-by: Nikita Danilov <nikita@clusterfs.com>
+Bug-Reference-ID: <17397.51015.769854.541057@gargle.gargle.HOWL>
+Bug-Reference-URL: http://lists.gnu.org/archive/html/bug-bash/2006-02/msg00064.html
+
+Bug-Description:
+
+Bash will dump core when attempting to perform globbing in directories with
+very large numbers of files.
+
+Patch:
+
+*** ../bash-3.1-patched/lib/glob/glob.c Thu Mar 24 12:42:27 2005
+--- lib/glob/glob.c Fri Mar 3 16:54:12 2006
+***************
+*** 361,364 ****
+--- 361,365 ----
+
+ firstmalloc = 0;
++ nalloca = 0;
+
+ /* If PAT is empty, skip the loop, but return one (empty) filename. */
+***************
+*** 547,550 ****
+--- 551,556 ----
+ tmplink = lastlink;
+ }
++ else
++ tmplink = 0;
+ free (lastlink->name);
+ lastlink = lastlink->next;
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 15
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 16
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/patches/source/bash/patches/bash31-017 b/patches/source/bash/patches/bash31-017
new file mode 100644
index 000000000..84f891551
--- /dev/null
+++ b/patches/source/bash/patches/bash31-017
@@ -0,0 +1,131 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-017
+
+Bug-Reported-by: syphir@syphir.sytes.net
+Bug-Reference-ID: <442421F5.3010105@syphir.sytes.net>
+Bug-Reference-URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=358831
+
+Bug-Description:
+
+Array expansion fails with an arithmetic syntax error when the subscript
+appears within double quotes. For example: ${a["4"]}.
+
+Patch:
+
+*** ../bash-3.1-patched/subst.c Wed Apr 12 08:47:08 2006
+--- subst.c Wed Apr 12 08:49:02 2006
+***************
+*** 2576,2579 ****
+--- 2576,2586 ----
+ }
+
++ char *
++ expand_arith_string (string, quoted)
++ char *string;
++ {
++ return (expand_string_if_necessary (string, quoted, expand_string));
++ }
++
+ #if defined (COND_COMMAND)
+ /* Just remove backslashes in STRING. Returns a new string. */
+***************
+*** 5249,5253 ****
+ t = (char *)0;
+
+! temp1 = expand_string_if_necessary (substr, Q_DOUBLE_QUOTES, expand_string);
+ *e1p = evalexp (temp1, &expok);
+ free (temp1);
+--- 5256,5260 ----
+ t = (char *)0;
+
+! temp1 = expand_arith_string (substr, Q_DOUBLE_QUOTES);
+ *e1p = evalexp (temp1, &expok);
+ free (temp1);
+***************
+*** 5294,5298 ****
+ t++;
+ temp2 = savestring (t);
+! temp1 = expand_string_if_necessary (temp2, Q_DOUBLE_QUOTES, expand_string);
+ free (temp2);
+ t[-1] = ':';
+--- 5301,5305 ----
+ t++;
+ temp2 = savestring (t);
+! temp1 = expand_arith_string (temp2, Q_DOUBLE_QUOTES);
+ free (temp2);
+ t[-1] = ':';
+***************
+*** 6436,6440 ****
+
+ /* Expand variables found inside the expression. */
+! temp1 = expand_string_if_necessary (temp2, Q_DOUBLE_QUOTES, expand_string);
+ free (temp2);
+
+--- 6443,6447 ----
+
+ /* Expand variables found inside the expression. */
+! temp1 = expand_arith_string (temp2, Q_DOUBLE_QUOTES);
+ free (temp2);
+
+***************
+*** 6478,6482 ****
+
+ /* Do initial variable expansion. */
+! temp1 = expand_string_if_necessary (temp, Q_DOUBLE_QUOTES, expand_string);
+
+ goto arithsub;
+--- 6485,6489 ----
+
+ /* Do initial variable expansion. */
+! temp1 = expand_arith_string (temp, Q_DOUBLE_QUOTES);
+
+ goto arithsub;
+*** ../bash-3.1-patched/subst.h Sun Nov 7 15:12:28 2004
+--- subst.h Mon Mar 27 09:10:38 2006
+***************
+*** 152,155 ****
+--- 152,158 ----
+ extern char *expand_assignment_string_to_string __P((char *, int));
+
++ /* Expand an arithmetic expression string */
++ extern char *expand_arith_string __P((char *, int));
++
+ /* De-quoted quoted characters in STRING. */
+ extern char *dequote_string __P((char *));
+*** ../bash-3.1-patched/arrayfunc.c Mon Jul 4 20:25:58 2005
+--- arrayfunc.c Mon Mar 27 09:10:47 2006
+***************
+*** 593,601 ****
+ strncpy (exp, s, len - 1);
+ exp[len - 1] = '\0';
+! #if 0
+! t = expand_string_to_string (exp, 0);
+! #else
+! t = expand_string_to_string (exp, Q_DOUBLE_QUOTES);
+! #endif
+ this_command_name = (char *)NULL;
+ val = evalexp (t, &expok);
+--- 591,595 ----
+ strncpy (exp, s, len - 1);
+ exp[len - 1] = '\0';
+! t = expand_arith_string (exp, 0);
+ this_command_name = (char *)NULL;
+ val = evalexp (t, &expok);
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 16
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 17
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/patches/source/bash/patches/bash31-018 b/patches/source/bash/patches/bash31-018
new file mode 100644
index 000000000..38510f902
--- /dev/null
+++ b/patches/source/bash/patches/bash31-018
@@ -0,0 +1,104 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-018
+
+Bug-Reported-by: Stephane Chazelas <stephane.chazelas@gmail.com>
+Bug-Reference-ID:
+Bug-Reference-URL:
+
+Bug-Description:
+
+Under certain circumstances, bash will execute user code while processing the
+environment for exported function definitions.
+
+Patch:
+
+*** ../bash-3.1.17/builtins/common.h 2004-09-09 13:21:08.000000000 -0400
+--- builtins/common.h 2014-09-16 22:00:02.000000000 -0400
+***************
+*** 34,37 ****
+--- 34,39 ----
+
+ /* Flags for describe_command, shared between type.def and command.def */
++ #define SEVAL_FUNCDEF 0x080 /* only allow function definitions */
++ #define SEVAL_ONECMD 0x100 /* only allow a single command */
+ #define CDESC_ALL 0x001 /* type -a */
+ #define CDESC_SHORTDESC 0x002 /* command -V */
+*** ../bash-3.1.17/builtins/evalstring.c 2005-10-30 18:28:24.000000000 -0500
+--- builtins/evalstring.c 2014-09-16 22:00:02.000000000 -0400
+***************
+*** 224,227 ****
+--- 224,235 ----
+ struct fd_bitmap *bitmap;
+
++ if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def)
++ {
++ internal_warning ("%s: ignoring function definition attempt", from_file);
++ should_jump_to_top_level = 0;
++ last_result = last_command_exit_value = EX_BADUSAGE;
++ break;
++ }
++
+ bitmap = new_fd_bitmap (FD_BITMAP_SIZE);
+ begin_unwind_frame ("pe_dispose");
+***************
+*** 279,282 ****
+--- 287,293 ----
+ dispose_fd_bitmap (bitmap);
+ discard_unwind_frame ("pe_dispose");
++
++ if (flags & SEVAL_ONECMD)
++ break;
+ }
+ }
+*** ../bash-3.1.17/variables.c 2006-03-10 16:56:29.000000000 -0500
+--- variables.c 2014-09-16 22:00:02.000000000 -0400
+***************
+*** 311,320 ****
+ strcpy (temp_string + char_index + 1, string);
+
+! parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST);
+!
+! /* Ancient backwards compatibility. Old versions of bash exported
+! functions like name()=() {...} */
+! if (name[char_index - 1] == ')' && name[char_index - 2] == '(')
+! name[char_index - 2] = '\0';
+
+ if (temp_var = find_function (name))
+--- 311,318 ----
+ strcpy (temp_string + char_index + 1, string);
+
+! /* Don't import function names that are invalid identifiers from the
+! environment. */
+! if (legal_identifier (name))
+! parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD);
+
+ if (temp_var = find_function (name))
+***************
+*** 325,332 ****
+ else
+ report_error (_("error importing function definition for `%s'"), name);
+-
+- /* ( */
+- if (name[char_index - 1] == ')' && name[char_index - 2] == '\0')
+- name[char_index - 2] = '('; /* ) */
+ }
+ #if defined (ARRAY_VARS)
+--- 323,326 ----
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 17
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 18
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/patches/source/bash/patches/bash31-019 b/patches/source/bash/patches/bash31-019
new file mode 100644
index 000000000..d39f63b45
--- /dev/null
+++ b/patches/source/bash/patches/bash31-019
@@ -0,0 +1,43 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-019
+
+Bug-Reported-by: Tavis Ormandy <taviso@cmpxchg8b.com>
+Bug-Reference-ID:
+Bug-Reference-URL: http://twitter.com/taviso/statuses/514887394294652929
+
+Bug-Description:
+
+Under certain circumstances, bash can incorrectly save a lookahead character and
+return it on a subsequent call, even when reading a new line.
+
+Patch:
+
+*** ../bash-3.1.18/parse.y 2006-04-12 08:40:35.000000000 -0400
+--- parse.y 2014-09-25 16:40:46.000000000 -0400
+***************
+*** 2501,2504 ****
+--- 2501,2506 ----
+ word_desc_to_read = (WORD_DESC *)NULL;
+
++ eol_ungetc_lookahead = 0;
++
+ last_read_token = '\n';
+ token_to_read = '\n';
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 18
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 19
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/patches/source/bash/patches/bash31-020 b/patches/source/bash/patches/bash31-020
new file mode 100644
index 000000000..8a488a4f3
--- /dev/null
+++ b/patches/source/bash/patches/bash31-020
@@ -0,0 +1,217 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-020
+
+Bug-Reported-by: Florian Weimer <fweimer@redhat.com>
+Bug-Reference-ID:
+Bug-Reference-URL:
+
+Bug-Description:
+
+This patch changes the encoding bash uses for exported functions to avoid
+clashes with shell variables and to avoid depending only on an environment
+variable's contents to determine whether or not to interpret it as a shell
+function.
+
+Patch:
+
+*** ../bash-3.1.19/variables.c 2014-09-16 22:00:02.000000000 -0400
+--- variables.c 2014-09-27 21:02:50.000000000 -0400
+***************
+*** 75,78 ****
+--- 75,83 ----
+ #define ifsname(s) ((s)[0] == 'I' && (s)[1] == 'F' && (s)[2] == 'S' && (s)[3] == '\0')
+
++ #define BASHFUNC_PREFIX "BASH_FUNC_"
++ #define BASHFUNC_PREFLEN 10 /* == strlen(BASHFUNC_PREFIX */
++ #define BASHFUNC_SUFFIX "%%"
++ #define BASHFUNC_SUFFLEN 2 /* == strlen(BASHFUNC_SUFFIX) */
++
+ extern char **environ;
+
+***************
+*** 240,244 ****
+ static void dispose_temporary_env __P((sh_free_func_t *));
+
+! static inline char *mk_env_string __P((const char *, const char *));
+ static char **make_env_array_from_var_list __P((SHELL_VAR **));
+ static char **make_var_export_array __P((VAR_CONTEXT *));
+--- 245,249 ----
+ static void dispose_temporary_env __P((sh_free_func_t *));
+
+! static inline char *mk_env_string __P((const char *, const char *, int));
+ static char **make_env_array_from_var_list __P((SHELL_VAR **));
+ static char **make_var_export_array __P((VAR_CONTEXT *));
+***************
+*** 302,320 ****
+ /* If exported function, define it now. Don't import functions from
+ the environment in privileged mode. */
+! if (privmode == 0 && read_but_dont_execute == 0 && STREQN ("() {", string, 4))
+ {
+ string_length = strlen (string);
+! temp_string = (char *)xmalloc (3 + string_length + char_index);
+
+! strcpy (temp_string, name);
+! temp_string[char_index] = ' ';
+! strcpy (temp_string + char_index + 1, string);
+
+ /* Don't import function names that are invalid identifiers from the
+ environment. */
+! if (legal_identifier (name))
+! parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD);
+
+! if (temp_var = find_function (name))
+ {
+ VSETATTR (temp_var, (att_exported|att_imported));
+--- 307,336 ----
+ /* If exported function, define it now. Don't import functions from
+ the environment in privileged mode. */
+! if (privmode == 0 && read_but_dont_execute == 0 &&
+! STREQN (BASHFUNC_PREFIX, name, BASHFUNC_PREFLEN) &&
+! STREQ (BASHFUNC_SUFFIX, name + char_index - BASHFUNC_SUFFLEN) &&
+! STREQN ("() {", string, 4))
+ {
++ size_t namelen;
++ char *tname; /* desired imported function name */
++
++ namelen = char_index - BASHFUNC_PREFLEN - BASHFUNC_SUFFLEN;
++
++ tname = name + BASHFUNC_PREFLEN; /* start of func name */
++ tname[namelen] = '\0'; /* now tname == func name */
++
+ string_length = strlen (string);
+! temp_string = (char *)xmalloc (namelen + string_length + 2);
+
+! memcpy (temp_string, tname, namelen);
+! temp_string[namelen] = ' ';
+! memcpy (temp_string + namelen + 1, string, string_length + 1);
+
+ /* Don't import function names that are invalid identifiers from the
+ environment. */
+! if (absolute_program (tname) == 0 && (posixly_correct == 0 || legal_identifier (tname)))
+! parse_and_execute (temp_string, tname, SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD);
+
+! if (temp_var = find_function (tname))
+ {
+ VSETATTR (temp_var, (att_exported|att_imported));
+***************
+*** 322,326 ****
+ }
+ else
+! report_error (_("error importing function definition for `%s'"), name);
+ }
+ #if defined (ARRAY_VARS)
+--- 338,345 ----
+ }
+ else
+! report_error (_("error importing function definition for `%s'"), tname);
+!
+! /* Restore original suffix */
+! tname[namelen] = BASHFUNC_SUFFIX[0];
+ }
+ #if defined (ARRAY_VARS)
+***************
+*** 2215,2219 ****
+
+ INVALIDATE_EXPORTSTR (var);
+! var->exportstr = mk_env_string (name, value);
+
+ array_needs_making = 1;
+--- 2234,2238 ----
+
+ INVALIDATE_EXPORTSTR (var);
+! var->exportstr = mk_env_string (name, value, 0);
+
+ array_needs_making = 1;
+***************
+*** 3003,3021 ****
+
+ static inline char *
+! mk_env_string (name, value)
+ const char *name, *value;
+ {
+! int name_len, value_len;
+! char *p;
+
+ name_len = strlen (name);
+ value_len = STRLEN (value);
+! p = (char *)xmalloc (2 + name_len + value_len);
+! strcpy (p, name);
+! p[name_len] = '=';
+ if (value && *value)
+! strcpy (p + name_len + 1, value);
+ else
+! p[name_len + 1] = '\0';
+ return (p);
+ }
+--- 3022,3061 ----
+
+ static inline char *
+! mk_env_string (name, value, isfunc)
+ const char *name, *value;
++ int isfunc;
+ {
+! size_t name_len, value_len;
+! char *p, *q;
+
+ name_len = strlen (name);
+ value_len = STRLEN (value);
+!
+! /* If we are exporting a shell function, construct the encoded function
+! name. */
+! if (isfunc && value)
+! {
+! p = (char *)xmalloc (BASHFUNC_PREFLEN + name_len + BASHFUNC_SUFFLEN + value_len + 2);
+! q = p;
+! memcpy (q, BASHFUNC_PREFIX, BASHFUNC_PREFLEN);
+! q += BASHFUNC_PREFLEN;
+! memcpy (q, name, name_len);
+! q += name_len;
+! memcpy (q, BASHFUNC_SUFFIX, BASHFUNC_SUFFLEN);
+! q += BASHFUNC_SUFFLEN;
+! }
+! else
+! {
+! p = (char *)xmalloc (2 + name_len + value_len);
+! memcpy (p, name, name_len);
+! q = p + name_len;
+! }
+!
+! q[0] = '=';
+ if (value && *value)
+! memcpy (q + 1, value, value_len + 1);
+ else
+! q[1] = '\0';
+!
+ return (p);
+ }
+***************
+*** 3092,3096 ****
+ using the cached exportstr... */
+ list[list_index] = USE_EXPORTSTR ? savestring (value)
+! : mk_env_string (var->name, value);
+
+ if (USE_EXPORTSTR == 0)
+--- 3132,3136 ----
+ using the cached exportstr... */
+ list[list_index] = USE_EXPORTSTR ? savestring (value)
+! : mk_env_string (var->name, value, function_p (var));
+
+ if (USE_EXPORTSTR == 0)
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 19
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 20
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/patches/source/bash/patches/bash31-021 b/patches/source/bash/patches/bash31-021
new file mode 100644
index 000000000..9e07c2868
--- /dev/null
+++ b/patches/source/bash/patches/bash31-021
@@ -0,0 +1,147 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-021
+
+Bug-Reported-by: Florian Weimer <fweimer@redhat.com>
+Bug-Reference-ID:
+Bug-Reference-URL:
+
+Bug-Description:
+
+There are two local buffer overflows in parse.y that can cause the shell
+to dump core when given many here-documents attached to a single command
+or many nested loops.
+
+Patch:
+
+*** ../bash-3.1.20/parse.y 2014-09-27 12:16:39.000000000 -0400
+--- parse.y 2014-09-30 19:49:41.000000000 -0400
+***************
+*** 167,170 ****
+--- 167,173 ----
+ static int reserved_word_acceptable __P((int));
+ static int yylex __P((void));
++
++ static void push_heredoc __P((REDIRECT *));
++ static char *mk_alexpansion __P((char *));
+ static int alias_expand_token __P((char *));
+ static int time_command_acceptable __P((void));
+***************
+*** 259,263 ****
+ /* Variables to manage the task of reading here documents, because we need to
+ defer the reading until after a complete command has been collected. */
+! static REDIRECT *redir_stack[10];
+ int need_here_doc;
+
+--- 262,268 ----
+ /* Variables to manage the task of reading here documents, because we need to
+ defer the reading until after a complete command has been collected. */
+! #define HEREDOC_MAX 16
+!
+! static REDIRECT *redir_stack[HEREDOC_MAX];
+ int need_here_doc;
+
+***************
+*** 285,289 ****
+ index is decremented after a case, select, or for command is parsed. */
+ #define MAX_CASE_NEST 128
+! static int word_lineno[MAX_CASE_NEST];
+ static int word_top = -1;
+
+--- 290,294 ----
+ index is decremented after a case, select, or for command is parsed. */
+ #define MAX_CASE_NEST 128
+! static int word_lineno[MAX_CASE_NEST+1];
+ static int word_top = -1;
+
+***************
+*** 430,434 ****
+ redir.filename = $2;
+ $$ = make_redirection (0, r_reading_until, redir);
+! redir_stack[need_here_doc++] = $$;
+ }
+ | NUMBER LESS_LESS WORD
+--- 435,439 ----
+ redir.filename = $2;
+ $$ = make_redirection (0, r_reading_until, redir);
+! push_heredoc ($$);
+ }
+ | NUMBER LESS_LESS WORD
+***************
+*** 436,440 ****
+ redir.filename = $3;
+ $$ = make_redirection ($1, r_reading_until, redir);
+! redir_stack[need_here_doc++] = $$;
+ }
+ | LESS_LESS_LESS WORD
+--- 441,445 ----
+ redir.filename = $3;
+ $$ = make_redirection ($1, r_reading_until, redir);
+! push_heredoc ($$);
+ }
+ | LESS_LESS_LESS WORD
+***************
+*** 493,497 ****
+ $$ = make_redirection
+ (0, r_deblank_reading_until, redir);
+! redir_stack[need_here_doc++] = $$;
+ }
+ | NUMBER LESS_LESS_MINUS WORD
+--- 498,502 ----
+ $$ = make_redirection
+ (0, r_deblank_reading_until, redir);
+! push_heredoc ($$);
+ }
+ | NUMBER LESS_LESS_MINUS WORD
+***************
+*** 500,504 ****
+ $$ = make_redirection
+ ($1, r_deblank_reading_until, redir);
+! redir_stack[need_here_doc++] = $$;
+ }
+ | GREATER_AND '-'
+--- 505,509 ----
+ $$ = make_redirection
+ ($1, r_deblank_reading_until, redir);
+! push_heredoc ($$);
+ }
+ | GREATER_AND '-'
+***************
+*** 2211,2214 ****
+--- 2216,2234 ----
+ static int esacs_needed_count;
+
++ static void
++ push_heredoc (r)
++ REDIRECT *r;
++ {
++ if (need_here_doc >= HEREDOC_MAX)
++ {
++ last_command_exit_value = EX_BADUSAGE;
++ need_here_doc = 0;
++ report_syntax_error (_("maximum here-document count exceeded"));
++ reset_parser ();
++ exit_shell (last_command_exit_value);
++ }
++ redir_stack[need_here_doc++] = r;
++ }
++
+ void
+ gather_here_documents ()
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 20
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 21
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/patches/source/bash/patches/bash31-022 b/patches/source/bash/patches/bash31-022
new file mode 100644
index 000000000..503ad0f9e
--- /dev/null
+++ b/patches/source/bash/patches/bash31-022
@@ -0,0 +1,59 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-022
+
+Bug-Reported-by: Michal Zalewski <lcamtuf@coredump.cx>
+Bug-Reference-ID:
+Bug-Reference-URL:
+
+Bug-Description:
+
+When bash is parsing a function definition that contains a here-document
+delimited by end-of-file (or end-of-string), it leaves the closing delimiter
+uninitialized. This can result in an invalid memory access when the parsed
+function is later copied.
+
+Patch:
+
+*** ../bash-3.1.21/make_cmd.c 2005-07-07 08:14:57.000000000 -0400
+--- make_cmd.c 2014-10-02 20:33:47.000000000 -0400
+***************
+*** 672,675 ****
+--- 672,676 ----
+ temp->redirector = source;
+ temp->redirectee = dest_and_filename;
++ temp->here_doc_eof = 0;
+ temp->instruction = instruction;
+ temp->flags = 0;
+*** ../bash-3.1.21/copy_cmd.c 2003-10-07 11:43:44.000000000 -0400
+--- copy_cmd.c 2014-10-02 20:33:47.000000000 -0400
+***************
+*** 117,121 ****
+ case r_reading_until:
+ case r_deblank_reading_until:
+! new_redirect->here_doc_eof = savestring (redirect->here_doc_eof);
+ /*FALLTHROUGH*/
+ case r_reading_string:
+--- 117,121 ----
+ case r_reading_until:
+ case r_deblank_reading_until:
+! new_redirect->here_doc_eof = redirect->here_doc_eof ? savestring (redirect->here_doc_eof) : 0;
+ /*FALLTHROUGH*/
+ case r_reading_string:
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 21
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 22
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/patches/source/bash/patches/bash31-023 b/patches/source/bash/patches/bash31-023
new file mode 100644
index 000000000..4dbbf78b7
--- /dev/null
+++ b/patches/source/bash/patches/bash31-023
@@ -0,0 +1,125 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.1
+Patch-ID: bash31-023
+
+Bug-Reported-by: Michal Zalewski <lcamtuf@coredump.cx>
+Bug-Reference-ID:
+Bug-Reference-URL:
+
+Bug-Description:
+
+A combination of nested command substitutions and function importing from
+the environment can cause bash to execute code appearing in the environment
+variable value following the function definition.
+
+Patch:
+
+*** ../bash-3.1.22/builtins/evalstring.c 2014-09-16 22:00:02.000000000 -0400
+--- builtins/evalstring.c 2014-10-04 16:10:47.000000000 -0400
+***************
+*** 44,47 ****
+--- 44,48 ----
+ #include "../redir.h"
+ #include "../trap.h"
++ #include "../bashintl.h"
+
+ #if defined (HISTORY)
+***************
+*** 224,233 ****
+ struct fd_bitmap *bitmap;
+
+! if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def)
+ {
+! internal_warning ("%s: ignoring function definition attempt", from_file);
+! should_jump_to_top_level = 0;
+! last_result = last_command_exit_value = EX_BADUSAGE;
+! break;
+ }
+
+--- 225,247 ----
+ struct fd_bitmap *bitmap;
+
+! if (flags & SEVAL_FUNCDEF)
+ {
+! char *x;
+!
+! /* If the command parses to something other than a straight
+! function definition, or if we have not consumed the entire
+! string, or if the parser has transformed the function
+! name (as parsing will if it begins or ends with shell
+! whitespace, for example), reject the attempt */
+! if (command->type != cm_function_def ||
+! ((x = parser_remaining_input ()) && *x) ||
+! (STREQ (from_file, command->value.Function_def->name->word) == 0))
+! {
+! internal_warning (_("%s: ignoring function definition attempt"), from_file);
+! should_jump_to_top_level = 0;
+! last_result = last_command_exit_value = EX_BADUSAGE;
+! reset_parser ();
+! break;
+! }
+ }
+
+***************
+*** 289,293 ****
+
+ if (flags & SEVAL_ONECMD)
+! break;
+ }
+ }
+--- 303,310 ----
+
+ if (flags & SEVAL_ONECMD)
+! {
+! reset_parser ();
+! break;
+! }
+ }
+ }
+*** ../bash-3.1.22/parse.y 2014-09-30 19:49:41.000000000 -0400
+--- parse.y 2014-10-04 16:10:47.000000000 -0400
+***************
+*** 2122,2125 ****
+--- 2122,2135 ----
+ }
+
++ char *
++ parser_remaining_input ()
++ {
++ if (shell_input_line == 0)
++ return 0;
++ if (shell_input_line_index < 0 || shell_input_line_index >= shell_input_line_len)
++ return '\0'; /* XXX */
++ return (shell_input_line + shell_input_line_index);
++ }
++
+ #ifdef INCLUDE_UNUSED
+ /* Back the input pointer up by one, effectively `ungetting' a character. */
+*** ../bash-3.1.22/shell.h 2003-06-01 15:04:36.000000000 -0400
+--- shell.h 2014-10-04 16:10:47.000000000 -0400
+***************
+*** 160,163 ****
+--- 160,165 ----
+
+ /* Let's try declaring these here. */
++ extern char *parser_remaining_input __P((void));
++
+ extern sh_parser_state_t *save_parser_state __P((sh_parser_state_t *));
+ extern void restore_parser_state __P((sh_parser_state_t *));
+*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005
+--- patchlevel.h Wed Dec 7 13:48:42 2005
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 22
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 23
+
+ #endif /* _PATCHLEVEL_H_ */