revert-all-at-newline history segfault

[Jared Yanovich]

Hi,

with the following in .inputrc:

  set revert-all-at-newline on

a segfault can be produced in bash:

  echo $'set -o 
emacs\npwd\n\cp\ca\cd\ce\cu./sort\n\cp\ca#\npwd\n\cp\ca\cd\ce\cp\cp' | ./bash 
--norc -i
  bash-4.3$ set -o emacs
  bash-4.3$ pwd
  /Users/yanovich/b/bash
  bash-4.3$ ./sort
  bash: ./sort: No such file or directory
  bash-4.3$ #./sort
  bash-4.3$ pwd
  /Users/yanovich/b/bash
  bash-4.3$ ./sort
  bash: ./sort: No such file or directory
  bash-4.3$ 
  bash(8610,0x7fff7bb91310) malloc: *** error for object 0xf000000000000000: 
pointer being freed was not allocated
  *** set a breakpoint in malloc_error_break to debug

This change from 4.2 -> 4.3 seems to be the culprit:

lib/readline/undo.c:
@@ -222,6 +233,18 @@ rl_do_undo ()

       release = rl_undo_list;
       rl_undo_list = rl_undo_list->next;
+
+      /* If we are editing a history entry, make sure the change is replicated
+        in the history entry's line */
+      cur = current_history ();
+      if (cur && cur->data && (UNDO_LIST *)cur->data == release)
+       {
+         temp = replace_history_entry (where_history (), rl_line_buffer, 
(histdata_t)rl_undo_list);
+         xfree (temp->line);
+         FREE (temp->timestamp);
+         xfree (temp);
+       }
+

Without deeply understanding the code here is a diff that fixes it for me:

diff --git a/lib/readline/misc.c b/lib/readline/misc.c
index da5c696..79622d6 100644
--- a/lib/readline/misc.c
+++ b/lib/readline/misc.c
@@ -462,13 +462,13 @@ _rl_revert_all_lines ()
          /* Set up rl_line_buffer and other variables from history entry */
          rl_replace_from_history (entry, 0);   /* entry->line is now current */
          /* Undo all changes to this history entry */
+         entry->data = 0;
          while (rl_undo_list)
            rl_do_undo ();
          /* And copy the reverted line back to the history entry, preserving
             the timestamp. */
          FREE (entry->line);
          entry->line = savestring (rl_line_buffer);
-         entry->data = 0;
        }
       entry = previous_history ();
     }

pgpXiAUWetRFu.pgp
Description: PGP signature