Package patch attached.
diff -puriN orig/readline5-5.2/debian/changelog readline5-5.2/debian/changelog --- orig/readline5-5.2/debian/changelog 2009-01-10 17:15:05.000000000 +0100 +++ readline5-5.2/debian/changelog 2009-01-10 17:07:39.000000000 +0100 @@ -1,3 +1,11 @@ +readline5 (5.2-3.1) unstable; urgency=low + + * Non-maintainer upload. + * Apply rl-input-eventhook.dpatch: Fix input data validation when run with + rl_event_hook. Closes: #498277. + + -- Arnaud Cornet <[email protected]> Sat, 10 Jan 2009 17:06:46 +0100 + readline5 (5.2-3) unstable; urgency=low * Build-depend on gcc-multilib instead of lib{32,64}c*-dev-*. diff -puriN orig/readline5-5.2/debian/patches/00list readline5-5.2/debian/patches/00list --- orig/readline5-5.2/debian/patches/00list 2009-01-10 17:15:05.000000000 +0100 +++ readline5-5.2/debian/patches/00list 2009-01-10 17:12:43.000000000 +0100 @@ -6,3 +6,4 @@ rl-001 rl-002 rl-003 rl-004 +rl-input-eventhook diff -puriN orig/readline5-5.2/debian/patches/rl-input-eventhook.dpatch readline5-5.2/debian/patches/rl-input-eventhook.dpatch --- orig/readline5-5.2/debian/patches/rl-input-eventhook.dpatch 1970-01-01 01:00:00.000000000 +0100 +++ readline5-5.2/debian/patches/rl-input-eventhook.dpatch 2009-01-10 17:25:01.000000000 +0100 @@ -0,0 +1,33 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## rl-input-eventhook.dpatch by <[email protected]> +## from Yoann Guillot's <[email protected]> original patch (Bug: #498277). +## +## All lines beginning with `## DP:' are a description of the patch. +## +## DP: Readline discards input data due to an off-by-one error on the ibuffer +## DP: free size calculation. This buffer is only used when the program +## DP: defines the rl_event_hook callback. +## DP: The following patch fixes the off-by-ones + +...@dpatch@ +diff -urNad readline5-5.2~/input.c readline5-5.2/input.c +--- readline5-5.2~/input.c 2006-08-16 21:15:16.000000000 +0200 ++++ readline5-5.2/input.c 2009-01-10 17:04:32.000000000 +0100 +@@ -134,7 +134,7 @@ + + *key = ibuffer[pop_index++]; + +- if (pop_index >= ibuffer_len) ++ if (pop_index > ibuffer_len) + pop_index = 0; + + return (1); +@@ -373,7 +373,7 @@ + RL_SETSTATE (RL_STATE_INPUTPENDING); + } + ibuffer[push_index++] = key; +- if (push_index >= ibuffer_len) ++ if (push_index > ibuffer_len) + push_index = 0; + + return 1;
