[Bug-readline] segfault on a call to rl_callback_read_char()

[Benoît Ryder]

Hi !

Using version 6.2, when rl_callback_handler_remove() is called from the
callback itself, rl_callback_read_char() may result in a segfault.
It happens when using a single-stroke binding to vi-eof-maybe shadowed by a
two-stroke binding starting by the same stroke.

For instance, using the following inputrc:

  "\C-a": vi-eof-maybe
  "\C-a\C-a": "x"

with the following program:

  #include <stdio.h>
  #include <readline/readline.h>

  static char *line;

  static void callback(char *text)
  {
    line = text;
    rl_callback_handler_remove();
  }

  int main(void)
  {
    rl_callback_handler_install(">> ", callback);
    line = NULL;
    while( line == NULL ) {
      rl_callback_read_char();
    }
    return 0;
  }


Typing "a" "<C-d>" "b" produces a segfault.


The callback is called twice: first with text "a" then with text "b", but the
callback is reset and it calls the NULL pointer the second time.

Note that it also happens when using other functions instead
'vi-eof-maybe', such as 'yank'.


Regards,

Benoît Ryder