1. photon
  2. Commit 12dfb38114e00239db87569cff9ad6d3b636436e
Browse code

Bash : Fix bash CVE-2016-9401, match bash version with upstream patch level

Change-Id: I0e757a5118ee4fe9c50a1263edd342b2284323b0
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/4289
Reviewed-by: Vinay Kulkarni <kulkarniv@vmware.com>
Tested-by: gerrit-photon <photon-checkins@vmware.com>

xiaolin-vmware authored on 2017/11/14 10:25:59
Showing 13 changed files
SPECS/bash/bash.spec
History View file @ 12dfb38
... ... 
@@ -1,19 +1,31 @@
1 
-Summary:	Bourne-Again SHell
2 
-Name:		bash
3 
-Version:	4.4
4 
-Release:	6%{?dist}
5 
-License:	GPLv3
6 
-URL:		http://www.gnu.org/software/bash/
7 
-Group:		System Environment/Base
8 
-Vendor:		VMware, Inc.
9 
-Distribution: Photon
10 
-Source0:	http://ftp.gnu.org/gnu/bash/%{name}-%{version}.tar.gz
11 
-%define sha1 bash=8de012df1e4f3e91f571c3eb8ec45b43d7c747eb
12 
-Source1:	bash_completion
13 
-Patch0:		bash-4.4.patch
14 
-Patch1:         CVE-2017-5932.patch
15 
-Provides:	/bin/sh
16 
-Provides:	/bin/bash
1 
+Summary:        Bourne-Again SHell
2 
+Name:           bash
3 
+Version:        4.4.12
4 
+Release:        1%{?dist}
5 
+License:        GPLv3
6 
+URL:            http://www.gnu.org/software/bash/
7 
+Group:          System Environment/Base
8 
+Vendor:         VMware, Inc.
9 
+Distribution:   Photon
10 
+Source0:        http://ftp.gnu.org/gnu/bash/%{name}-4.4.tar.gz
11 
+%define sha1    bash=8de012df1e4f3e91f571c3eb8ec45b43d7c747eb
12 
+Source1:        bash_completion
13 
+Patch0:         bash-4.4.patch
14 
+#Upstream patches
15 
+Patch001:       bash44-001
16 
+Patch002:       bash44-002
17 
+Patch003:       bash44-003
18 
+Patch004:       bash44-004
19 
+Patch005:       bash44-005
20 
+Patch006:       bash44-006
21 
+Patch007:       bash44-007
22 
+Patch008:       bash44-008
23 
+Patch009:       bash44-009
24 
+Patch010:       bash44-010
25 
+Patch011:       bash44-011
26 
+Patch012:       bash44-012
27 
+Provides:       /bin/sh
28 
+Provides:       /bin/bash
17 29 
 BuildRequires:  readline
18 30 
 Requires:       readline
19 31 
 Requires(post):    /bin/grep
... ... 
@@ -23,10 +35,10 @@ Requires(postun):  /bin/mv
23 23 
 %description
24 24 
 The package contains the Bourne-Again SHell
25 25
26 
-%package	devel
27 
-Summary:	Header and development files for bash
28 
-Requires:	%{name} = %{version}
29 
-%description	devel
26 
+%package    devel
27 
+Summary:    Header and development files for bash
28 
+Requires:   %{name} = %{version}
29 
+%description    devel
30 30 
 It contains the libraries and header files to create applications
31 31
32 32 
 %package lang
... ... 
@@ -37,17 +49,28 @@ Requires: bash >= 4.4
37 37 
 These are the additional language files of bash.
38 38
39 39 
 %prep
40 
-%setup -q
40 
+%setup -q -n bash-4.4
41 41 
 %patch0 -p1
42 
-%patch1 -p1
42 
+%patch001 -p0
43 
+%patch002 -p0
44 
+%patch003 -p0
45 
+%patch004 -p0
46 
+%patch005 -p0
47 
+%patch006 -p0
48 
+%patch007 -p0
49 
+%patch008 -p0
50 
+%patch009 -p0
51 
+%patch010 -p0
52 
+%patch011 -p0
53 
+%patch012 -p0
43 54 
 %build
44 55 
 ./configure \
45 
-	"CFLAGS=-fPIC" \
46 
-	--prefix=%{_prefix} \
47 
-	--bindir=/bin \
48 
-	--htmldir=%{_defaultdocdir}/%{name}-%{version} \
49 
-	--without-bash-malloc \
50 
-	--with-installed-readline
56 
+    "CFLAGS=-fPIC" \
57 
+    --prefix=%{_prefix} \
58 
+    --bindir=/bin \
59 
+    --htmldir=%{_defaultdocdir}/%{name}-%{version} \
60 
+    --without-bash-malloc \
61 
+    --with-installed-readline
51 62 
 make %{?_smp_mflags}
52 63 
 %install
53 64 
 make DESTDIR=%{buildroot} install
... ... 
@@ -314,6 +337,8 @@ fi
314 314 
 %defattr(-,root,root)
315 315
316 316 
 %changelog
317 
+*   Mon Nov 13 2017 Xiaolin Li <xiaolinl@vmware.com> 4.4.12-1
318 
+-   Upstream patch level 12 applied
317 319 
 *   Mon Oct 02 2017 Kumar Kaushik <kaushikk@vmware.com> 4.4-6
318 320 
 -   Adding security fix for CVE-2017-5932.
319 321 
 *   Thu Jun 8 2017 Bo Gan <ganb@vmware.com> 4.4-5
SPECS/bash/bash44-001
History View file @ 12dfb38
320 322 
new file mode 100644
... ... 
@@ -0,0 +1,60 @@
0 
+			     BASH PATCH REPORT
1 
+			     =================
2 
+
3 
+Bash-Release:	4.4
4 
+Patch-ID:	bash44-001
5 
+
6 
+Bug-Reported-by:	Sean Zha <freeman_cha@hotmail.com>
7 
+Bug-Reference-ID:	<BN3PR01MB13657D9303EB94BF6E54216E8CCA0@BN3PR01MB1365.prod.exchangelabs.com>
8 
+Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2016-09/msg00107.html
9 
+
10 
+Bug-Description:
11 
+
12 
+Bash-4.4 changed the way the history list is initially allocated to reduce
13 
+the number of reallocations and copies.  Users who set HISTSIZE to a very
14 
+large number to essentially unlimit the size of the history list will get
15 
+memory allocation errors
16 
+
17 
+Patch (apply with `patch -p0'):
18 
+
19 
+*** ../bash-4.4/lib/readline/history.c	2015-12-28 13:50:31.000000000 -0500
20 
+--- lib/readline/history.c	2016-09-30 14:28:40.000000000 -0400
21 
+***************
22 
+*** 58,61 ****
23 
+--- 58,63 ----
24 
+  #define DEFAULT_HISTORY_INITIAL_SIZE	502
25 
+
26 
++ #define MAX_HISTORY_INITIAL_SIZE	8192
27 
++
28 
+  /* The number of slots to increase the_history by. */
29 
+  #define DEFAULT_HISTORY_GROW_SIZE 50
30 
+***************
31 
+*** 308,312 ****
32 
+  	{
33 
+  	  if (history_stifled && history_max_entries > 0)
34 
+! 	    history_size = history_max_entries + 2;
35 
+  	  else
36 
+  	    history_size = DEFAULT_HISTORY_INITIAL_SIZE;
37 
+--- 310,316 ----
38 
+  	{
39 
+  	  if (history_stifled && history_max_entries > 0)
40 
+! 	    history_size = (history_max_entries > MAX_HISTORY_INITIAL_SIZE)
41 
+! 				? MAX_HISTORY_INITIAL_SIZE
42 
+! 				: history_max_entries + 2;
43 
+  	  else
44 
+  	    history_size = DEFAULT_HISTORY_INITIAL_SIZE;
45 
+*** ../bash-4.4/patchlevel.h	2016-06-22 14:51:03.000000000 -0400
46 
+--- patchlevel.h	2016-10-01 11:01:28.000000000 -0400
47 
+***************
48 
+*** 26,30 ****
49 
+     looks for to find the patch level (for the sccs version string). */
50 
+
51 
+! #define PATCHLEVEL 0
52 
+
53 
+  #endif /* _PATCHLEVEL_H_ */
54 
+--- 26,30 ----
55 
+     looks for to find the patch level (for the sccs version string). */
56 
+
57 
+! #define PATCHLEVEL 1
58 
+
59 
+  #endif /* _PATCHLEVEL_H_ */
SPECS/bash/bash44-002
History View file @ 12dfb38
0 60 
new file mode 100644
... ... 
@@ -0,0 +1,69 @@
0 
+			     BASH PATCH REPORT
1 
+			     =================
2 
+
3 
+Bash-Release:	4.4
4 
+Patch-ID:	bash44-002
5 
+
6 
+Bug-Reported-by:	Eric Pruitt <eric.pruitt@gmail.com>
7 
+Bug-Reference-ID:	<20160916055120.GA28272@sinister.codevat.com>
8 
+Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2016-09/msg00015.html
9 
+
10 
+Bug-Description:
11 
+
12 
+Bash-4.4 warns when discarding NUL bytes in command substitution output
13 
+instead of silently dropping them.  This patch changes the warnings from
14 
+one per NUL byte encountered to one warning per command substitution.
15 
+
16 
+Patch (apply with `patch -p0'):
17 
+
18 
+*** ../bash-4.4/subst.c	2016-08-30 16:46:38.000000000 -0400
19 
+--- subst.c	2016-09-26 10:20:19.000000000 -0400
20 
+***************
21 
+*** 5932,5935 ****
22 
+--- 5933,5937 ----
23 
+    int istring_index, istring_size, c, tflag, skip_ctlesc, skip_ctlnul;
24 
+    ssize_t bufn;
25 
++   int nullbyte;
26 
+
27 
+    istring = (char *)NULL;
28 
+***************
29 
+*** 5939,5942 ****
30 
+--- 5941,5946 ----
31 
+      skip_ctlesc |= *s == CTLESC, skip_ctlnul |= *s == CTLNUL;
32 
+
33 
++   nullbyte = 0;
34 
++
35 
+    /* Read the output of the command through the pipe.  This may need to be
36 
+       changed to understand multibyte characters in the future. */
37 
+***************
38 
+*** 5957,5961 ****
39 
+  	{
40 
+  #if 1
41 
+! 	  internal_warning ("%s", _("command substitution: ignored null byte in input"));
42 
+  #endif
43 
+  	  continue;
44 
+--- 5961,5969 ----
45 
+  	{
46 
+  #if 1
47 
+! 	  if (nullbyte == 0)
48 
+! 	    {
49 
+! 	      internal_warning ("%s", _("command substitution: ignored null byte in input"));
50 
+! 	      nullbyte = 1;
51 
+! 	    }
52 
+  #endif
53 
+  	  continue;
54 
+*** ../bash-4.4/patchlevel.h	2016-06-22 14:51:03.000000000 -0400
55 
+--- patchlevel.h	2016-10-01 11:01:28.000000000 -0400
56 
+***************
57 
+*** 26,30 ****
58 
+     looks for to find the patch level (for the sccs version string). */
59 
+
60 
+! #define PATCHLEVEL 1
61 
+
62 
+  #endif /* _PATCHLEVEL_H_ */
63 
+--- 26,30 ----
64 
+     looks for to find the patch level (for the sccs version string). */
65 
+
66 
+! #define PATCHLEVEL 2
67 
+
68 
+  #endif /* _PATCHLEVEL_H_ */
SPECS/bash/bash44-003
History View file @ 12dfb38
0 69 
new file mode 100644
... ... 
@@ -0,0 +1,58 @@
0 
+			     BASH PATCH REPORT
1 
+			     =================
2 
+
3 
+Bash-Release:	4.4
4 
+Patch-ID:	bash44-003
5 
+
6 
+Bug-Reported-by:	op7ic \x00 <op7ica@gmail.com>
7 
+Bug-Reference-ID:	<CAFHyJTopWC5Jx+U7WcvxSZKu+KrqSf+_3sHPiRWo=VzXSiPq=w@mail.gmail.com>
8 
+Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2016-11/msg00005.html
9 
+
10 
+Bug-Description:
11 
+
12 
+Specially-crafted input, in this case an incomplete pathname expansion
13 
+bracket expression containing an invalid collating symbol, can cause the
14 
+shell to crash.
15 
+
16 
+Patch (apply with `patch -p0'):
17 
+
18 
+*** ../bash-4.4/lib/glob/sm_loop.c	2016-04-10 11:23:21.000000000 -0400
19 
+--- lib/glob/sm_loop.c	2016-11-02 14:03:34.000000000 -0400
20 
+***************
21 
+*** 331,334 ****
22 
+--- 331,340 ----
23 
+      if (p[pc] == L('.') && p[pc+1] == L(']'))
24 
+        break;
25 
++    if (p[pc] == 0)
26 
++     {
27 
++       if (vp)
28 
++ 	*vp = INVALID;
29 
++       return (p + pc);
30 
++     }
31 
+     val = COLLSYM (p, pc);
32 
+     if (vp)
33 
+***************
34 
+*** 484,487 ****
35 
+--- 490,496 ----
36 
+        c = FOLD (c);
37 
+
38 
++       if (c == L('\0'))
39 
++ 	return ((test == L('[')) ? savep : (CHAR *)0);
40 
++
41 
+        if ((flags & FNM_PATHNAME) && c == L('/'))
42 
+  	/* [/] can never match when matching a pathname.  */
43 
+*** ../bash-4.4/patchlevel.h	2016-06-22 14:51:03.000000000 -0400
44 
+--- patchlevel.h	2016-10-01 11:01:28.000000000 -0400
45 
+***************
46 
+*** 26,30 ****
47 
+     looks for to find the patch level (for the sccs version string). */
48 
+
49 
+! #define PATCHLEVEL 2
50 
+
51 
+  #endif /* _PATCHLEVEL_H_ */
52 
+--- 26,30 ----
53 
+     looks for to find the patch level (for the sccs version string). */
54 
+
55 
+! #define PATCHLEVEL 3
56 
+
57 
+  #endif /* _PATCHLEVEL_H_ */
SPECS/bash/bash44-004
History View file @ 12dfb38
0 58 
new file mode 100644
... ... 
@@ -0,0 +1,84 @@
0 
+			     BASH PATCH REPORT
1 
+			     =================
2 
+
3 
+Bash-Release:	4.4
4 
+Patch-ID:	bash44-004
5 
+
6 
+Bug-Reported-by:	Christian Weisgerber <naddy@mips.inka.de>
7 
+Bug-Reference-ID:	<20161101160302.GB54856@lorvorc.mips.inka.de>
8 
+Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2016-11/msg00004.html
9 
+
10 
+Bug-Description:
11 
+
12 
+There is a race condition that can result in bash referencing freed memory
13 
+when freeing data associated with the last process substitution.
14 
+
15 
+Patch (apply with `patch -p0'):
16 
+
17 
+*** ../bash-4.4/jobs.c	2016-08-23 16:38:44.000000000 -0400
18 
+--- jobs.c	2016-11-02 18:24:45.000000000 -0400
19 
+***************
20 
+*** 454,457 ****
21 
+--- 454,472 ----
22 
+  }
23 
+
24 
++ void
25 
++ discard_last_procsub_child ()
26 
++ {
27 
++   PROCESS *disposer;
28 
++   sigset_t set, oset;
29 
++
30 
++   BLOCK_CHILD (set, oset);
31 
++   disposer = last_procsub_child;
32 
++   last_procsub_child = (PROCESS *)NULL;
33 
++   UNBLOCK_CHILD (oset);
34 
++
35 
++   if (disposer)
36 
++     discard_pipeline (disposer);
37 
++ }
38 
++
39 
+  struct pipeline_saver *
40 
+  alloc_pipeline_saver ()
41 
+*** ../bash-4.4/jobs.h	2016-04-27 10:35:51.000000000 -0400
42 
+--- jobs.h	2016-11-02 18:25:08.000000000 -0400
43 
+***************
44 
+*** 191,194 ****
45 
+--- 191,195 ----
46 
+  extern void stop_making_children __P((void));
47 
+  extern void cleanup_the_pipeline __P((void));
48 
++ extern void discard_last_procsub_child __P((void));
49 
+  extern void save_pipeline __P((int));
50 
+  extern PROCESS *restore_pipeline __P((int));
51 
+*** ../bash-4.4/subst.c	2016-08-30 16:46:38.000000000 -0400
52 
+--- subst.c	2016-11-02 18:23:24.000000000 -0400
53 
+***************
54 
+*** 5809,5816 ****
55 
+  #if defined (JOB_CONTROL)
56 
+        if (last_procsub_child)
57 
+! 	{
58 
+! 	  discard_pipeline (last_procsub_child);
59 
+! 	  last_procsub_child = (PROCESS *)NULL;
60 
+! 	}
61 
+        last_procsub_child = restore_pipeline (0);
62 
+  #endif
63 
+--- 5834,5838 ----
64 
+  #if defined (JOB_CONTROL)
65 
+        if (last_procsub_child)
66 
+! 	discard_last_procsub_child ();
67 
+        last_procsub_child = restore_pipeline (0);
68 
+  #endif
69 
+*** ../bash-4.4/patchlevel.h	2016-06-22 14:51:03.000000000 -0400
70 
+--- patchlevel.h	2016-10-01 11:01:28.000000000 -0400
71 
+***************
72 
+*** 26,30 ****
73 
+     looks for to find the patch level (for the sccs version string). */
74 
+
75 
+! #define PATCHLEVEL 3
76 
+
77 
+  #endif /* _PATCHLEVEL_H_ */
78 
+--- 26,30 ----
79 
+     looks for to find the patch level (for the sccs version string). */
80 
+
81 
+! #define PATCHLEVEL 4
82 
+
83 
+  #endif /* _PATCHLEVEL_H_ */
SPECS/bash/bash44-005
History View file @ 12dfb38
0 84 
new file mode 100644
... ... 
@@ -0,0 +1,47 @@
0 
+			     BASH PATCH REPORT
1 
+			     =================
2 
+
3 
+Bash-Release:	4.4
4 
+Patch-ID:	bash44-005
5 
+
6 
+Bug-Reported-by:	Dr. Werner Fink <werner@suse.de>
7 
+Bug-Reference-ID:	<20161107100936.ajnojd7dspirdflf@noether.suse.de>
8 
+Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2016-11/msg00054.html
9 
+
10 
+Bug-Description:
11 
+
12 
+Under certain circumstances, a simple command is optimized to eliminate a
13 
+fork, resulting in an EXIT trap not being executed.
14 
+
15 
+Patch (apply with `patch -p0'):
16 
+
17 
+*** ../bash-4.4/builtins/evalstring.c	2016-08-11 14:18:51.000000000 -0400
18 
+--- builtins/evalstring.c	2016-11-08 15:05:07.000000000 -0500
19 
+***************
20 
+*** 105,114 ****
21 
+  	  *bash_input.location.string == '\0' &&
22 
+  	  command->type == cm_simple &&
23 
+- #if 0
24 
+  	  signal_is_trapped (EXIT_TRAP) == 0 &&
25 
+  	  signal_is_trapped (ERROR_TRAP) == 0 &&
26 
+- #else
27 
+  	  any_signals_trapped () < 0 &&
28 
+- #endif
29 
+  	  command->redirects == 0 && command->value.Simple->redirects == 0 &&
30 
+  	  ((command->flags & CMD_TIME_PIPELINE) == 0) &&
31 
+--- 105,111 ----
32 
+*** ../bash-4.4/patchlevel.h	2016-06-22 14:51:03.000000000 -0400
33 
+--- patchlevel.h	2016-10-01 11:01:28.000000000 -0400
34 
+***************
35 
+*** 26,30 ****
36 
+     looks for to find the patch level (for the sccs version string). */
37 
+
38 
+! #define PATCHLEVEL 4
39 
+
40 
+  #endif /* _PATCHLEVEL_H_ */
41 
+--- 26,30 ----
42 
+     looks for to find the patch level (for the sccs version string). */
43 
+
44 
+! #define PATCHLEVEL 5
45 
+
46 
+  #endif /* _PATCHLEVEL_H_ */
SPECS/bash/bash44-006
History View file @ 12dfb38
0 47 
new file mode 100644
... ... 
@@ -0,0 +1,59 @@
0 
+			     BASH PATCH REPORT
1 
+			     =================
2 
+
3 
+Bash-Release:	4.4
4 
+Patch-ID:	bash44-006
5 
+
6 
+Bug-Reported-by:	<fernando@null-life.com>
7 
+Bug-Reference-ID:	<CAEr-gPFPvqheiAeENmMkEwWRd4U=1iqCsYmR3sLdULOqL++_tQ@mail.gmail.com>
8 
+Bug-Reference-URL:
9 
+
10 
+Bug-Description:
11 
+
12 
+Out-of-range negative offsets to popd can cause the shell to crash attempting
13 
+to free an invalid memory block.
14 
+
15 
+Patch (apply with `patch -p0'):
16 
+
17 
+*** ../bash-4.4-patched/builtins/pushd.def	2016-01-25 13:31:49.000000000 -0500
18 
+--- builtins/pushd.def	2016-10-28 10:46:49.000000000 -0400
19 
+***************
20 
+*** 366,370 ****
21 
+      }
22 
+
23 
+!   if (which > directory_list_offset || (directory_list_offset == 0 && which == 0))
24 
+      {
25 
+        pushd_error (directory_list_offset, which_word ? which_word : "");
26 
+--- 366,370 ----
27 
+      }
28 
+
29 
+!   if (which > directory_list_offset || (which < -directory_list_offset) || (directory_list_offset == 0 && which == 0))
30 
+      {
31 
+        pushd_error (directory_list_offset, which_word ? which_word : "");
32 
+***************
33 
+*** 388,391 ****
34 
+--- 388,396 ----
35 
+  	 of the list into place. */
36 
+        i = (direction == '+') ? directory_list_offset - which : which;
37 
++       if (i < 0 || i > directory_list_offset)
38 
++ 	{
39 
++ 	  pushd_error (directory_list_offset, which_word ? which_word : "");
40 
++ 	  return (EXECUTION_FAILURE);
41 
++ 	}
42 
+        free (pushd_directory_list[i]);
43 
+        directory_list_offset--;
44 
+*** ../bash-4.4/patchlevel.h	2016-06-22 14:51:03.000000000 -0400
45 
+--- patchlevel.h	2016-10-01 11:01:28.000000000 -0400
46 
+***************
47 
+*** 26,30 ****
48 
+     looks for to find the patch level (for the sccs version string). */
49 
+
50 
+! #define PATCHLEVEL 5
51 
+
52 
+  #endif /* _PATCHLEVEL_H_ */
53 
+--- 26,30 ----
54 
+     looks for to find the patch level (for the sccs version string). */
55 
+
56 
+! #define PATCHLEVEL 6
57 
+
58 
+  #endif /* _PATCHLEVEL_H_ */
SPECS/bash/bash44-007
History View file @ 12dfb38
0 59 
new file mode 100644
... ... 
@@ -0,0 +1,151 @@
0 
+			     BASH PATCH REPORT
1 
+			     =================
2 
+
3 
+Bash-Release:	4.4
4 
+Patch-ID:	bash44-007
5 
+
6 
+Bug-Reported-by:	Jens Heyens <jens.heyens@cispa.saarland>
7 
+Bug-Reference-ID:
8 
+Bug-Reference-URL:	https://savannah.gnu.org/support/?109224
9 
+
10 
+Bug-Description:
11 
+
12 
+When performing filename completion, bash dequotes the directory name being
13 
+completed, which can result in match failures and potential unwanted
14 
+expansion.
15 
+
16 
+Patch (apply with `patch -p0'):
17 
+
18 
+*** ../bash-4.4-patched/bashline.c	2016-08-05 21:44:05.000000000 -0400
19 
+--- bashline.c	2017-01-19 13:15:51.000000000 -0500
20 
+***************
21 
+*** 143,147 ****
22 
+  static void restore_directory_hook __P((rl_icppfunc_t));
23 
+
24 
+! static int directory_exists __P((const char *));
25 
+
26 
+  static void cleanup_expansion_error __P((void));
27 
+--- 144,148 ----
28 
+  static void restore_directory_hook __P((rl_icppfunc_t));
29 
+
30 
+! static int directory_exists __P((const char *, int));
31 
+
32 
+  static void cleanup_expansion_error __P((void));
33 
+***************
34 
+*** 3103,3111 ****
35 
+  }
36 
+
37 
+! /* Check whether not the (dequoted) version of DIRNAME, with any trailing slash
38 
+!    removed, exists. */
39 
+  static int
40 
+! directory_exists (dirname)
41 
+       const char *dirname;
42 
+  {
43 
+    char *new_dirname;
44 
+--- 3107,3116 ----
45 
+  }
46 
+
47 
+! /* Check whether not DIRNAME, with any trailing slash removed, exists.  If
48 
+!    SHOULD_DEQUOTE is non-zero, we dequote the directory name first. */
49 
+  static int
50 
+! directory_exists (dirname, should_dequote)
51 
+       const char *dirname;
52 
++      int should_dequote;
53 
+  {
54 
+    char *new_dirname;
55 
+***************
56 
+*** 3113,3118 ****
57 
+    struct stat sb;
58 
+
59 
+!   /* First, dequote the directory name */
60 
+!   new_dirname = bash_dequote_filename ((char *)dirname, rl_completion_quote_character);
61 
+    dirlen = STRLEN (new_dirname);
62 
+    if (new_dirname[dirlen - 1] == '/')
63 
+--- 3118,3124 ----
64 
+    struct stat sb;
65 
+
66 
+!   /* We save the string and chop the trailing slash because stat/lstat behave
67 
+!      inconsistently if one is present. */
68 
+!   new_dirname = should_dequote ? bash_dequote_filename ((char *)dirname, rl_completion_quote_character) : savestring (dirname);
69 
+    dirlen = STRLEN (new_dirname);
70 
+    if (new_dirname[dirlen - 1] == '/')
71 
+***************
72 
+*** 3146,3150 ****
73 
+      should_expand_dirname = '`';
74 
+
75 
+!   if (should_expand_dirname && directory_exists (local_dirname))
76 
+      should_expand_dirname = 0;
77 
+
78 
+--- 3152,3156 ----
79 
+      should_expand_dirname = '`';
80 
+
81 
+!   if (should_expand_dirname && directory_exists (local_dirname, 0))
82 
+      should_expand_dirname = 0;
83 
+
84 
+***************
85 
+*** 3156,3160 ****
86 
+        global_nounset = unbound_vars_is_error;
87 
+        unbound_vars_is_error = 0;
88 
+!       wl = expand_prompt_string (new_dirname, 0, W_NOCOMSUB|W_COMPLETE);	/* does the right thing */
89 
+        unbound_vars_is_error = global_nounset;
90 
+        if (wl)
91 
+--- 3162,3166 ----
92 
+        global_nounset = unbound_vars_is_error;
93 
+        unbound_vars_is_error = 0;
94 
+!       wl = expand_prompt_string (new_dirname, 0, W_NOCOMSUB|W_NOPROCSUB|W_COMPLETE);	/* does the right thing */
95 
+        unbound_vars_is_error = global_nounset;
96 
+        if (wl)
97 
+***************
98 
+*** 3245,3249 ****
99 
+      }
100 
+
101 
+!   if (should_expand_dirname && directory_exists (local_dirname))
102 
+      should_expand_dirname = 0;
103 
+
104 
+--- 3262,3266 ----
105 
+      }
106 
+
107 
+!   if (should_expand_dirname && directory_exists (local_dirname, 1))
108 
+      should_expand_dirname = 0;
109 
+
110 
+***************
111 
+*** 3251,3255 ****
112 
+      {
113 
+        new_dirname = savestring (local_dirname);
114 
+!       wl = expand_prompt_string (new_dirname, 0, W_NOCOMSUB|W_COMPLETE);	/* does the right thing */
115 
+        if (wl)
116 
+  	{
117 
+--- 3268,3272 ----
118 
+      {
119 
+        new_dirname = savestring (local_dirname);
120 
+!       wl = expand_prompt_string (new_dirname, 0, W_NOCOMSUB|W_NOPROCSUB|W_COMPLETE);	/* does the right thing */
121 
+        if (wl)
122 
+  	{
123 
+*** ../bash-4.4/subst.c	2016-08-30 16:46:38.000000000 -0400
124 
+--- subst.c	2017-01-19 07:09:57.000000000 -0500
125 
+***************
126 
+*** 9459,9462 ****
127 
+--- 9459,9466 ----
128 
+  	      if (word->flags & W_COMPLETE)
129 
+  		tword->flags |= W_COMPLETE;	/* for command substitutions */
130 
++ 	      if (word->flags & W_NOCOMSUB)
131 
++ 		tword->flags |= W_NOCOMSUB;
132 
++ 	      if (word->flags & W_NOPROCSUB)
133 
++ 		tword->flags |= W_NOPROCSUB;
134 
+
135 
+  	      temp = (char *)NULL;
136 
+*** ../bash-4.4/patchlevel.h	2016-06-22 14:51:03.000000000 -0400
137 
+--- patchlevel.h	2016-10-01 11:01:28.000000000 -0400
138 
+***************
139 
+*** 26,30 ****
140 
+     looks for to find the patch level (for the sccs version string). */
141 
+
142 
+! #define PATCHLEVEL 6
143 
+
144 
+  #endif /* _PATCHLEVEL_H_ */
145 
+--- 26,30 ----
146 
+     looks for to find the patch level (for the sccs version string). */
147 
+
148 
+! #define PATCHLEVEL 7
149 
+
150 
+  #endif /* _PATCHLEVEL_H_ */
SPECS/bash/bash44-008
History View file @ 12dfb38
0 151 
new file mode 100644
... ... 
@@ -0,0 +1,84 @@
0 
+			     BASH PATCH REPORT
1 
+			     =================
2 
+
3 
+Bash-Release:	4.4
4 
+Patch-ID:	bash44-008
5 
+
6 
+Bug-Reported-by:	Koichi MURASE <myoga.murase@gmail.com>
7 
+Bug-Reference-ID:	<CAFLRLk-V+1AeQ2k=pY7ih6V+MfQ_w8EF3YWL2E+wmLfgKBtzXA@mail.gmail.com>
8 
+Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2016-11/msg00050.html
9 
+
10 
+Bug-Description:
11 
+
12 
+Under certain circumstances, bash will evaluate arithmetic expressions as
13 
+part of reading an expression token even when evaluation is suppressed. This
14 
+happens while evaluating a conditional expression and skipping over the
15 
+failed branch of the expression.
16 
+
17 
+Patch (apply with `patch -p0'):
18 
+
19 
+*** ../bash-4.4-patched/expr.c	2015-10-11 14:46:36.000000000 -0400
20 
+--- expr.c	2016-11-08 11:55:46.000000000 -0500
21 
+***************
22 
+*** 579,585 ****
23 
+    if (curtok == QUES)		/* found conditional expr */
24 
+      {
25 
+-       readtok ();
26 
+-       if (curtok == 0 || curtok == COL)
27 
+- 	evalerror (_("expression expected"));
28 
+        if (cval == 0)
29 
+  	{
30 
+--- 579,582 ----
31 
+***************
32 
+*** 588,591 ****
33 
+--- 585,592 ----
34 
+  	}
35 
+
36 
++       readtok ();
37 
++       if (curtok == 0 || curtok == COL)
38 
++ 	evalerror (_("expression expected"));
39 
++
40 
+        val1 = EXP_HIGHEST ();
41 
+
42 
+***************
43 
+*** 594,600 ****
44 
+        if (curtok != COL)
45 
+  	evalerror (_("`:' expected for conditional expression"));
46 
+!       readtok ();
47 
+!       if (curtok == 0)
48 
+! 	evalerror (_("expression expected"));
49 
+        set_noeval = 0;
50 
+        if (cval)
51 
+--- 595,599 ----
52 
+        if (curtok != COL)
53 
+  	evalerror (_("`:' expected for conditional expression"));
54 
+!
55 
+        set_noeval = 0;
56 
+        if (cval)
57 
+***************
58 
+*** 604,608 ****
59 
+--- 603,611 ----
60 
+   	}
61 
+
62 
++       readtok ();
63 
++       if (curtok == 0)
64 
++ 	evalerror (_("expression expected"));
65 
+        val2 = expcond ();
66 
++
67 
+        if (set_noeval)
68 
+  	noeval--;
69 
+*** ../bash-4.4/patchlevel.h	2016-06-22 14:51:03.000000000 -0400
70 
+--- patchlevel.h	2016-10-01 11:01:28.000000000 -0400
71 
+***************
72 
+*** 26,30 ****
73 
+     looks for to find the patch level (for the sccs version string). */
74 
+
75 
+! #define PATCHLEVEL 7
76 
+
77 
+  #endif /* _PATCHLEVEL_H_ */
78 
+--- 26,30 ----
79 
+     looks for to find the patch level (for the sccs version string). */
80 
+
81 
+! #define PATCHLEVEL 8
82 
+
83 
+  #endif /* _PATCHLEVEL_H_ */
SPECS/bash/bash44-009
History View file @ 12dfb38
0 84 
new file mode 100644
... ... 
@@ -0,0 +1,107 @@
0 
+			     BASH PATCH REPORT
1 
+			     =================
2 
+
3 
+Bash-Release:	4.4
4 
+Patch-ID:	bash44-009
5 
+
6 
+Bug-Reported-by:	Hong Cho <hong.cho@citrix.com>
7 
+Bug-Reference-ID:	<c30b5fe62b2543af8297e47ca487c29c@SJCPEX02CL02.citrite.net>
8 
+Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2016-12/msg00043.html
9 
+
10 
+Bug-Description:
11 
+
12 
+There is a race condition in add_history() that can be triggered by a fatal
13 
+signal arriving between the time the history length is updated and the time
14 
+the history list update is completed. A later attempt to reference an
15 
+invalid history entry can cause a crash.
16 
+
17 
+Patch (apply with `patch -p0'):
18 
+
19 
+*** ../bash-4.4-patched/lib/readline/history.c	2016-11-11 13:42:49.000000000 -0500
20 
+--- lib/readline/history.c	2016-12-05 10:37:51.000000000 -0500
21 
+***************
22 
+*** 280,283 ****
23 
+--- 280,284 ----
24 
+  {
25 
+    HIST_ENTRY *temp;
26 
++   int new_length;
27 
+
28 
+    if (history_stifled && (history_length == history_max_entries))
29 
+***************
30 
+*** 296,306 ****
31 
+        /* Copy the rest of the entries, moving down one slot.  Copy includes
32 
+  	 trailing NULL.  */
33 
+- #if 0
34 
+-       for (i = 0; i < history_length; i++)
35 
+- 	the_history[i] = the_history[i + 1];
36 
+- #else
37 
+        memmove (the_history, the_history + 1, history_length * sizeof (HIST_ENTRY *));
38 
+- #endif
39 
+
40 
+        history_base++;
41 
+      }
42 
+--- 297,303 ----
43 
+        /* Copy the rest of the entries, moving down one slot.  Copy includes
44 
+  	 trailing NULL.  */
45 
+        memmove (the_history, the_history + 1, history_length * sizeof (HIST_ENTRY *));
46 
+
47 
++       new_length = history_length;
48 
+        history_base++;
49 
+      }
50 
+***************
51 
+*** 316,320 ****
52 
+  	    history_size = DEFAULT_HISTORY_INITIAL_SIZE;
53 
+  	  the_history = (HIST_ENTRY **)xmalloc (history_size * sizeof (HIST_ENTRY *));
54 
+! 	  history_length = 1;
55 
+  	}
56 
+        else
57 
+--- 313,317 ----
58 
+  	    history_size = DEFAULT_HISTORY_INITIAL_SIZE;
59 
+  	  the_history = (HIST_ENTRY **)xmalloc (history_size * sizeof (HIST_ENTRY *));
60 
+! 	  new_length = 1;
61 
+  	}
62 
+        else
63 
+***************
64 
+*** 326,330 ****
65 
+  		xrealloc (the_history, history_size * sizeof (HIST_ENTRY *));
66 
+  	    }
67 
+! 	  history_length++;
68 
+  	}
69 
+      }
70 
+--- 323,327 ----
71 
+  		xrealloc (the_history, history_size * sizeof (HIST_ENTRY *));
72 
+  	    }
73 
+! 	  new_length = history_length + 1;
74 
+  	}
75 
+      }
76 
+***************
77 
+*** 332,337 ****
78 
+    temp = alloc_history_entry ((char *)string, hist_inittime ());
79 
+
80 
+!   the_history[history_length] = (HIST_ENTRY *)NULL;
81 
+!   the_history[history_length - 1] = temp;
82 
+  }
83 
+
84 
+--- 329,335 ----
85 
+    temp = alloc_history_entry ((char *)string, hist_inittime ());
86 
+
87 
+!   the_history[new_length] = (HIST_ENTRY *)NULL;
88 
+!   the_history[new_length - 1] = temp;
89 
+!   history_length = new_length;
90 
+  }
91 
+
92 
+*** ../bash-4.4/patchlevel.h	2016-06-22 14:51:03.000000000 -0400
93 
+--- patchlevel.h	2016-10-01 11:01:28.000000000 -0400
94 
+***************
95 
+*** 26,30 ****
96 
+     looks for to find the patch level (for the sccs version string). */
97 
+
98 
+! #define PATCHLEVEL 8
99 
+
100 
+  #endif /* _PATCHLEVEL_H_ */
101 
+--- 26,30 ----
102 
+     looks for to find the patch level (for the sccs version string). */
103 
+
104 
+! #define PATCHLEVEL 9
105 
+
106 
+  #endif /* _PATCHLEVEL_H_ */
SPECS/bash/bash44-010
History View file @ 12dfb38
0 107 
new file mode 100644
... ... 
@@ -0,0 +1,49 @@
0 
+			     BASH PATCH REPORT
1 
+			     =================
2 
+
3 
+Bash-Release:	4.4
4 
+Patch-ID:	bash44-010
5 
+
6 
+Bug-Reported-by:	Clark Wang <dearvoid@gmail.com>
7 
+Bug-Reference-ID:	<CADv8-og092RvvUUHy46=BPKChCXw5g=GOOqgN0V3f4a3TpLebQ@mail.gmail.com>
8 
+Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2016-11/msg00104.html
9 
+
10 
+Bug-Description:
11 
+
12 
+Depending on compiler optimizations and behavior, the `read' builtin may not
13 
+save partial input when a timeout occurs.
14 
+
15 
+Patch (apply with `patch -p0'):
16 
+
17 
+*** ../bash-4.4-patched/builtins/read.def	2016-05-16 14:24:56.000000000 -0400
18 
+--- builtins/read.def	2016-11-25 12:37:56.000000000 -0500
19 
+***************
20 
+*** 182,186 ****
21 
+  {
22 
+    register char *varname;
23 
+!   int size, i, nr, pass_next, saw_escape, eof, opt, retval, code, print_ps2;
24 
+    int input_is_tty, input_is_pipe, unbuffered_read, skip_ctlesc, skip_ctlnul;
25 
+    int raw, edit, nchars, silent, have_timeout, ignore_delim, fd, lastsig, t_errno;
26 
+--- 182,187 ----
27 
+  {
28 
+    register char *varname;
29 
+!   int size, nr, pass_next, saw_escape, eof, opt, retval, code, print_ps2;
30 
+!   volatile int i;
31 
+    int input_is_tty, input_is_pipe, unbuffered_read, skip_ctlesc, skip_ctlnul;
32 
+    int raw, edit, nchars, silent, have_timeout, ignore_delim, fd, lastsig, t_errno;
33 
+
34 
+*** ../bash-4.4/patchlevel.h	2016-06-22 14:51:03.000000000 -0400
35 
+--- patchlevel.h	2016-10-01 11:01:28.000000000 -0400
36 
+***************
37 
+*** 26,30 ****
38 
+     looks for to find the patch level (for the sccs version string). */
39 
+
40 
+! #define PATCHLEVEL 9
41 
+
42 
+  #endif /* _PATCHLEVEL_H_ */
43 
+--- 26,30 ----
44 
+     looks for to find the patch level (for the sccs version string). */
45 
+
46 
+! #define PATCHLEVEL 10
47 
+
48 
+  #endif /* _PATCHLEVEL_H_ */
SPECS/bash/bash44-011
History View file @ 12dfb38
0 49 
new file mode 100644
... ... 
@@ -0,0 +1,50 @@
0 
+			     BASH PATCH REPORT
1 
+			     =================
2 
+
3 
+Bash-Release:	4.4
4 
+Patch-ID:	bash44-011
5 
+
6 
+Bug-Reported-by:	Russell King <rmk@armlinux.org.uk>
7 
+Bug-Reference-ID:	<E1cNnFx-0007G2-S2@flint.armlinux.org.uk>
8 
+Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2017-01/msg00000.html
9 
+
10 
+Bug-Description:
11 
+
12 
+Subshells begun to run command and process substitutions may attempt to
13 
+set the terminal's process group to an incorrect value if they receive
14 
+a fatal signal.  This depends on the behavior of the process that starts
15 
+the shell.
16 
+
17 
+Patch (apply with `patch -p0'):
18 
+
19 
+*** ../bash-4.4-patched/sig.c	2016-02-11 15:02:45.000000000 -0500
20 
+--- sig.c	2017-01-04 09:09:47.000000000 -0500
21 
+***************
22 
+*** 586,590 ****
23 
+    if (sig == SIGHUP && (interactive || (subshell_environment & (SUBSHELL_COMSUB|SUBSHELL_PROCSUB))))
24 
+      hangup_all_jobs ();
25 
+!   end_job_control ();
26 
+  #endif /* JOB_CONTROL */
27 
+
28 
+--- 571,576 ----
29 
+    if (sig == SIGHUP && (interactive || (subshell_environment & (SUBSHELL_COMSUB|SUBSHELL_PROCSUB))))
30 
+      hangup_all_jobs ();
31 
+!   if ((subshell_environment & (SUBSHELL_COMSUB|SUBSHELL_PROCSUB)) == 0)
32 
+!     end_job_control ();
33 
+  #endif /* JOB_CONTROL */
34 
+
35 
+*** ../bash-4.4/patchlevel.h	2016-06-22 14:51:03.000000000 -0400
36 
+--- patchlevel.h	2016-10-01 11:01:28.000000000 -0400
37 
+***************
38 
+*** 26,30 ****
39 
+     looks for to find the patch level (for the sccs version string). */
40 
+
41 
+! #define PATCHLEVEL 10
42 
+
43 
+  #endif /* _PATCHLEVEL_H_ */
44 
+--- 26,30 ----
45 
+     looks for to find the patch level (for the sccs version string). */
46 
+
47 
+! #define PATCHLEVEL 11
48 
+
49 
+  #endif /* _PATCHLEVEL_H_ */
SPECS/bash/bash44-012
History View file @ 12dfb38
0 50 
new file mode 100644
... ... 
@@ -0,0 +1,161 @@
0 
+			     BASH PATCH REPORT
1 
+			     =================
2 
+
3 
+Bash-Release:	4.4
4 
+Patch-ID:	bash44-012
5 
+
6 
+Bug-Reported-by:	Clark Wang <dearvoid@gmail.com>
7 
+Bug-Reference-ID:	<CADv8-ojttPUFOZXqbjsvy83LfaJtQKZ5qejGdF6j0VJ3vtrYOA@mail.gmail.com>
8 
+Bug-Reference-URL:	http://lists.gnu.org/archive/html/bug-bash/2016-11/msg00106.html
9 
+
10 
+Bug-Description:
11 
+
12 
+When -N is used, the input is not supposed to be split using $IFS, but
13 
+leading and trailing IFS whitespace was still removed.
14 
+
15 
+Patch (apply with `patch -p0'):
16 
+
17 
+*** ../bash-4.4-patched/subst.c	2017-01-20 14:22:01.000000000 -0500
18 
+--- subst.c	2017-01-25 13:43:22.000000000 -0500
19 
+***************
20 
+*** 2826,2834 ****
21 
+  /* Parse a single word from STRING, using SEPARATORS to separate fields.
22 
+     ENDPTR is set to the first character after the word.  This is used by
23 
+!    the `read' builtin.  This is never called with SEPARATORS != $IFS;
24 
+!    it should be simplified.
25 
+
26 
+     XXX - this function is very similar to list_string; they should be
27 
+  	 combined - XXX */
28 
+  char *
29 
+  get_word_from_string (stringp, separators, endptr)
30 
+--- 2826,2838 ----
31 
+  /* Parse a single word from STRING, using SEPARATORS to separate fields.
32 
+     ENDPTR is set to the first character after the word.  This is used by
33 
+!    the `read' builtin.
34 
+!
35 
+!    This is never called with SEPARATORS != $IFS, and takes advantage of that.
36 
+
37 
+     XXX - this function is very similar to list_string; they should be
38 
+  	 combined - XXX */
39 
++
40 
++ #define islocalsep(c)	(local_cmap[(unsigned char)(c)] != 0)
41 
++
42 
+  char *
43 
+  get_word_from_string (stringp, separators, endptr)
44 
+***************
45 
+*** 2838,2841 ****
46 
+--- 2842,2846 ----
47 
+    char *current_word;
48 
+    int sindex, sh_style_split, whitesep, xflags;
49 
++   unsigned char local_cmap[UCHAR_MAX+1];	/* really only need single-byte chars here */
50 
+    size_t slen;
51 
+
52 
+***************
53 
+*** 2847,2854 ****
54 
+  				 separators[2] == '\n' &&
55 
+  				 separators[3] == '\0';
56 
+!   for (xflags = 0, s = ifs_value; s && *s; s++)
57 
+      {
58 
+        if (*s == CTLESC) xflags |= SX_NOCTLESC;
59 
+        if (*s == CTLNUL) xflags |= SX_NOESCCTLNUL;
60 
+      }
61 
+
62 
+--- 2852,2861 ----
63 
+  				 separators[2] == '\n' &&
64 
+  				 separators[3] == '\0';
65 
+!   memset (local_cmap, '\0', sizeof (local_cmap));
66 
+!   for (xflags = 0, s = separators; s && *s; s++)
67 
+      {
68 
+        if (*s == CTLESC) xflags |= SX_NOCTLESC;
69 
+        if (*s == CTLNUL) xflags |= SX_NOESCCTLNUL;
70 
++       local_cmap[(unsigned char)*s] = 1;	/* local charmap of separators */
71 
+      }
72 
+
73 
+***************
74 
+*** 2857,2864 ****
75 
+
76 
+    /* Remove sequences of whitespace at the beginning of STRING, as
77 
+!      long as those characters appear in IFS. */
78 
+!   if (sh_style_split || !separators || !*separators)
79 
+      {
80 
+!       for (; *s && spctabnl (*s) && isifs (*s); s++);
81 
+
82 
+        /* If the string is nothing but whitespace, update it and return. */
83 
+--- 2864,2872 ----
84 
+
85 
+    /* Remove sequences of whitespace at the beginning of STRING, as
86 
+!      long as those characters appear in SEPARATORS.  This happens if
87 
+!      SEPARATORS == $' \t\n' or if IFS is unset. */
88 
+!   if (sh_style_split || separators == 0)
89 
+      {
90 
+!       for (; *s && spctabnl (*s) && islocalsep (*s); s++);
91 
+
92 
+        /* If the string is nothing but whitespace, update it and return. */
93 
+***************
94 
+*** 2879,2885 ****
95 
+       This obeys the field splitting rules in Posix.2. */
96 
+    sindex = 0;
97 
+!   /* Don't need string length in ADVANCE_CHAR or string_extract_verbatim
98 
+!      unless multibyte chars are possible. */
99 
+!   slen = (MB_CUR_MAX > 1) ? STRLEN (s) : 1;
100 
+    current_word = string_extract_verbatim (s, slen, &sindex, separators, xflags);
101 
+
102 
+--- 2887,2893 ----
103 
+       This obeys the field splitting rules in Posix.2. */
104 
+    sindex = 0;
105 
+!   /* Don't need string length in ADVANCE_CHAR unless multibyte chars are
106 
+!      possible, but need it in string_extract_verbatim for bounds checking */
107 
+!   slen = STRLEN (s);
108 
+    current_word = string_extract_verbatim (s, slen, &sindex, separators, xflags);
109 
+
110 
+***************
111 
+*** 2900,2904 ****
112 
+    /* Now skip sequences of space, tab, or newline characters if they are
113 
+       in the list of separators. */
114 
+!   while (s[sindex] && spctabnl (s[sindex]) && isifs (s[sindex]))
115 
+      sindex++;
116 
+
117 
+--- 2908,2912 ----
118 
+    /* Now skip sequences of space, tab, or newline characters if they are
119 
+       in the list of separators. */
120 
+!   while (s[sindex] && spctabnl (s[sindex]) && islocalsep (s[sindex]))
121 
+      sindex++;
122 
+
123 
+***************
124 
+*** 2907,2916 ****
125 
+       delimiter, not a separate delimiter that would result in an empty field.
126 
+       Look at POSIX.2, 3.6.5, (3)(b). */
127 
+!   if (s[sindex] && whitesep && isifs (s[sindex]) && !spctabnl (s[sindex]))
128 
+      {
129 
+        sindex++;
130 
+        /* An IFS character that is not IFS white space, along with any adjacent
131 
+  	 IFS white space, shall delimit a field. */
132 
+!       while (s[sindex] && spctabnl (s[sindex]) && isifs (s[sindex]))
133 
+  	sindex++;
134 
+      }
135 
+--- 2915,2924 ----
136 
+       delimiter, not a separate delimiter that would result in an empty field.
137 
+       Look at POSIX.2, 3.6.5, (3)(b). */
138 
+!   if (s[sindex] && whitesep && islocalsep (s[sindex]) && !spctabnl (s[sindex]))
139 
+      {
140 
+        sindex++;
141 
+        /* An IFS character that is not IFS white space, along with any adjacent
142 
+  	 IFS white space, shall delimit a field. */
143 
+!       while (s[sindex] && spctabnl (s[sindex]) && islocalsep(s[sindex]))
144 
+  	sindex++;
145 
+      }
146 
+*** ../bash-4.4/patchlevel.h	2016-06-22 14:51:03.000000000 -0400
147 
+--- patchlevel.h	2016-10-01 11:01:28.000000000 -0400
148 
+***************
149 
+*** 26,30 ****
150 
+     looks for to find the patch level (for the sccs version string). */
151 
+
152 
+! #define PATCHLEVEL 11
153 
+
154 
+  #endif /* _PATCHLEVEL_H_ */
155 
+--- 26,30 ----
156 
+     looks for to find the patch level (for the sccs version string). */
157 
+
158 
+! #define PATCHLEVEL 12
159 
+
160 
+  #endif /* _PATCHLEVEL_H_ */