- Update from version 5.3 patch 9 to 5.3 patch 15
- No change in rootfile
- Changelog
patch 10
Under some circumstances, a subshell or asynchronous job with an active
EXIT trap that contains a call to `wait' can loop trying to wait for
processes that are not its children. It usually inherits these jobs from
its parent in the jobs list.
patch 11
If a `mapfile' callback unsets the array variable `mapfile' is using to
save
the lines it reads, `mapfile' can try to reference freed memory, which
can
cause corruption or shell crashes.
patch 12
If a subshell with an inherited EXIT trap receives a fatal signal before
it clears the exit trap, and before it restores its original signal
handlers, it's possible for it to inappropriately run the inherited EXIT
trap.
patch 13
Comparing the value of a pointer returned from realloc/xrealloc to the
original pointer passed is technically undefined behavior, which matters
under some circumstances.
patch 14
Bash-5.3 patch 11 included an inadvertent extra line, which this patch
removes. This also takes the opportunity to improve that patch, by
looking
up the variable each time through the line-reading loop only if there is
a callback and it is invoked.
patch 15
There are circumstances under which index -1 is used to reference into
the input buffer used by the `read' builtin.
Signed-off-by: Adolf Belka <[email protected]>
---
lfs/bash | 4 +-
src/patches/bash/bash53-010 | 49 +++++++++++++++++++++++
src/patches/bash/bash53-011 | 70 ++++++++++++++++++++++++++++++++
src/patches/bash/bash53-012 | 80 +++++++++++++++++++++++++++++++++++++
src/patches/bash/bash53-013 | 54 +++++++++++++++++++++++++
src/patches/bash/bash53-014 | 68 +++++++++++++++++++++++++++++++
src/patches/bash/bash53-015 | 79 ++++++++++++++++++++++++++++++++++++
7 files changed, 402 insertions(+), 2 deletions(-)
create mode 100644 src/patches/bash/bash53-010
create mode 100644 src/patches/bash/bash53-011
create mode 100644 src/patches/bash/bash53-012
create mode 100644 src/patches/bash/bash53-013
create mode 100644 src/patches/bash/bash53-014
create mode 100644 src/patches/bash/bash53-015
diff --git a/lfs/bash b/lfs/bash
index fd68e8805..dbee213c2 100644
--- a/lfs/bash
+++ b/lfs/bash
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2025 IPFire Team <[email protected]> #
+# Copyright (C) 2007-2026 IPFire Team <[email protected]> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -25,7 +25,7 @@
include Config
VER = 5.3
-PATCHVER = 9
+PATCHVER = 15
THISAPP = bash-$(VER)
DL_FILE = $(THISAPP).tar.gz
diff --git a/src/patches/bash/bash53-010 b/src/patches/bash/bash53-010
new file mode 100644
index 000000000..3797675a0
--- /dev/null
+++ b/src/patches/bash/bash53-010
@@ -0,0 +1,49 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 5.3
+Patch-ID: bash53-010
+
+Bug-Reported-by: Aleksey Covacevice <[email protected]>
+Bug-Reference-ID:
+Bug-Reference-URL:
https://lists.gnu.org/archive/html/bug-bash/2026-01/msg00003.html
+
+Bug-Description:
+
+Patch (apply with `patch -p0'):
+
+Under some circumstances, a subshell or asynchronous job with an active
+EXIT trap that contains a call to `wait' can loop trying to wait for
+processes that are not its children. It usually inherits these jobs from
+its parent in the jobs list.
+
+*** ../bash-5.3-patched/jobs.c Fri Jul 25 08:53:22 2025
+--- jobs.c Fri Jan 9 10:21:03 2026
+***************
+*** 2840,2844 ****
+ ps->status = (r < 0 || r > 256) ? 127 : r;
+ }
+! if (r == -1 && errno == ECHILD)
+ {
+ /* If we're mistaken about job state, compensate. */
+--- 2842,2846 ----
+ ps->status = (r < 0 || r > 256) ? 127 : r;
+ }
+! if ((r < 0 || r > 256) && errno == ECHILD)
+ {
+ /* If we're mistaken about job state, compensate. */
+*** ../bash-5.3/patchlevel.h 2020-06-22 14:51:03.000000000 -0400
+--- patchlevel.h 2020-10-01 11:01:28.000000000 -0400
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 9
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 10
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/src/patches/bash/bash53-011 b/src/patches/bash/bash53-011
new file mode 100644
index 000000000..5aa8b9222
--- /dev/null
+++ b/src/patches/bash/bash53-011
@@ -0,0 +1,70 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 5.3
+Patch-ID: bash53-011
+
+Bug-Reported-by: Philippe Grégoire <[email protected]>
+Bug-Reference-ID:
+Bug-Reference-URL:
+
+Bug-Description:
+
+If a `mapfile' callback unsets the array variable `mapfile' is using to save
+the lines it reads, `mapfile' can try to reference freed memory, which can
+cause corruption or shell crashes.
+
+Patch (apply with `patch -p0'):
+
+*** ../bash-5.3-patched/builtins/mapfile.def Mon May 6 11:58:48 2024
+--- builtins/mapfile.def Mon May 25 16:23:50 2026
+***************
+*** 154,160 ****
+ unbuffered_read = 0;
+
+! /* The following check should be done before reading any lines. Doing it
+! here allows us to call bind_array_element instead of bind_array_variable
+! and skip the variable lookup on every call. */
+ entry = builtin_find_indexed_array (array_name, flags & MAPF_CLEARARRAY);
+ if (entry == 0)
+--- 154,158 ----
+ unbuffered_read = 0;
+
+! /* The following check should be done before reading any lines. */
+ entry = builtin_find_indexed_array (array_name, flags & MAPF_CLEARARRAY);
+ if (entry == 0)
+***************
+*** 202,207 ****
+ }
+
+! /* XXX - bad things can happen if the callback modifies ENTRY, e.g.,
+! unsetting it or changing it to a non-indexed-array type. */
+ bind_array_element (entry, array_index, line, 0);
+
+--- 200,210 ----
+ }
+
+! /* Bad things can happen if the callback modifies ENTRY, e.g.,
+! unsetting it or changing it to a non-indexed-array type, so we
+! look it up again every time we need to assign something */
+! entry = bind_array_variable (array_name, array_index, line, 0);
+! if (entry == 0 || ASSIGN_DISALLOWED (entry, 0))
+! return EXECUTION_FAILURE;
+!
+ bind_array_element (entry, array_index, line, 0);
+
+*** ../bash-5.3/patchlevel.h 2020-06-22 14:51:03.000000000 -0400
+--- patchlevel.h 2020-10-01 11:01:28.000000000 -0400
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 10
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 11
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/src/patches/bash/bash53-012 b/src/patches/bash/bash53-012
new file mode 100644
index 000000000..aac53bc72
--- /dev/null
+++ b/src/patches/bash/bash53-012
@@ -0,0 +1,80 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 5.3
+Patch-ID: bash53-012
+
+Bug-Reported-by: [email protected]
+Bug-Reference-ID:
+Bug-Reference-URL: https://savannah.gnu.org/bugs/?67745
+
+Bug-Description:
+
+If a subshell with an inherited EXIT trap receives a fatal signal before
+it clears the exit trap, and before it restores its original signal
+handlers, it's possible for it to inappropriately run the inherited EXIT
+trap.
+
+Patch (apply with `patch -p0'):
+
+*** ../bash-5.3-patched/execute_cmd.c Thu Jun 5 11:02:01 2025
+--- execute_cmd.c Fri Jan 9 10:21:30 2026
+***************
+*** 1644,1648 ****
+ if (user_subshell)
+ {
+! subshell_environment = SUBSHELL_PAREN; /* XXX */
+ if (asynchronous)
+ subshell_environment |= SUBSHELL_ASYNC;
+--- 1681,1685 ----
+ if (user_subshell)
+ {
+! subshell_environment = SUBSHELL_PAREN|SUBSHELL_IGNTRAP; /* XXX
*/
+ if (asynchronous)
+ subshell_environment |= SUBSHELL_ASYNC;
+***************
+*** 1650,1654 ****
+ else
+ {
+! subshell_environment = 0; /* XXX */
+ if (asynchronous)
+ subshell_environment |= SUBSHELL_ASYNC;
+--- 1687,1691 ----
+ else
+ {
+! subshell_environment = SUBSHELL_IGNTRAP; /* XXX
*/
+ if (asynchronous)
+ subshell_environment |= SUBSHELL_ASYNC;
+*** ../bash-5.3-patched/sig.c Wed Dec 18 15:52:06 2024
+--- sig.c Fri Jan 9 10:21:43 2026
+***************
+*** 639,643 ****
+ comsub_ignore_return = return_catch_flag = wait_intr_flag = 0;
+
+! run_exit_trap (); /* XXX - run exit trap possibly in signal context? */
+
+ kill_shell (sig);
+--- 645,652 ----
+ comsub_ignore_return = return_catch_flag = wait_intr_flag = 0;
+
+! /* Don't run the exit trap if we're supposed to be ignoring traps in a
+! subshell environment. */
+! if ((subshell_environment & SUBSHELL_IGNTRAP) == 0)
+! run_exit_trap (); /* XXX - run exit trap possibly in signal
context? */
+
+ kill_shell (sig);
+*** ../bash-5.3/patchlevel.h 2020-06-22 14:51:03.000000000 -0400
+--- patchlevel.h 2020-10-01 11:01:28.000000000 -0400
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 11
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 12
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/src/patches/bash/bash53-013 b/src/patches/bash/bash53-013
new file mode 100644
index 000000000..16ff707c7
--- /dev/null
+++ b/src/patches/bash/bash53-013
@@ -0,0 +1,54 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 5.3
+Patch-ID: bash53-013
+
+Bug-Reported-by: Florian Schmaus <[email protected]>
+Bug-Reference-ID:
+Bug-Reference-URL: https://savannah.gnu.org/bugs/?67586
+
+Bug-Description:
+
+Comparing the value of a pointer returned from realloc/xrealloc to the
+original pointer passed is technically undefined behavior, which matters
+under some circumstances.
+
+Patch (apply with `patch -p0'):
+
+*** ../bash-5.3-patched/builtins/read.def Wed Jun 25 15:50:18 2025
+--- builtins/read.def Thu Nov 20 15:10:20 2025
+***************
+*** 789,794 ****
+ x = (char *)xrealloc (input_string, size += 128);
+
+! /* Only need to change unwind-protect if input_string changes */
+ if (x != input_string)
+ {
+ input_string = x;
+--- 816,824 ----
+ x = (char *)xrealloc (input_string, size += 128);
+
+! #if 0
+! /* This is, in theory, undefined behavior, since input_string may
+! have been freed. */
+ if (x != input_string)
++ #endif
+ {
+ input_string = x;
+
+*** ../bash-5.3/patchlevel.h 2020-06-22 14:51:03.000000000 -0400
+--- patchlevel.h 2020-10-01 11:01:28.000000000 -0400
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 12
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 13
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/src/patches/bash/bash53-014 b/src/patches/bash/bash53-014
new file mode 100644
index 000000000..d52d34d29
--- /dev/null
+++ b/src/patches/bash/bash53-014
@@ -0,0 +1,68 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 5.3
+Patch-ID: bash53-014
+
+Bug-Reported-by: Grisha Levit <[email protected]>
+Bug-Reference-ID:
+Bug-Reference-URL:
https://lists.gnu.org/archive/html/bug-bash/2026-06/msg00022.html
+
+Bug-Description:
+
+Bash-5.3 patch 11 included an inadvertent extra line, which this patch
+removes. This also takes the opportunity to improve that patch, by looking
+up the variable each time through the line-reading loop only if there is
+a callback and it is invoked.
+
+Patch (apply with `patch -p0'):
+
+*** ../bash-5.3-patched/builtins/mapfile.def Sat Jun 6 13:31:02 2026
+--- builtins/mapfile.def Sat Jun 6 13:51:55 2026
+***************
+*** 198,211 ****
+
+ run_callback (callback, array_index, line);
+- }
+
+! /* Bad things can happen if the callback modifies ENTRY, e.g.,
+! unsetting it or changing it to a non-indexed-array type, so we
+! look it up again every time we need to assign something */
+! entry = bind_array_variable (array_name, array_index, line, 0);
+! if (entry == 0 || ASSIGN_DISALLOWED (entry, 0))
+! return EXECUTION_FAILURE;
+!
+! bind_array_element (entry, array_index, line, 0);
+
+ /* Have we exceeded # of lines to store? */
+--- 198,211 ----
+
+ run_callback (callback, array_index, line);
+
+! /* Bad things can happen if the callback modifies ENTRY, e.g.,
+! unsetting it or changing it to a non-indexed-array type, so we
+! look it up again every time we need to assign something */
+! entry = bind_array_variable (array_name, array_index, line, 0);
+! if (entry == 0 || ASSIGN_DISALLOWED (entry, 0))
+! return EXECUTION_FAILURE;
+! }
+! else
+! bind_array_element (entry, array_index, line, 0);
+
+ /* Have we exceeded # of lines to store? */
+
+*** ../bash-5.3/patchlevel.h 2020-06-22 14:51:03.000000000 -0400
+--- patchlevel.h 2020-10-01 11:01:28.000000000 -0400
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 13
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 14
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/src/patches/bash/bash53-015 b/src/patches/bash/bash53-015
new file mode 100644
index 000000000..861b3cac0
--- /dev/null
+++ b/src/patches/bash/bash53-015
@@ -0,0 +1,79 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 5.3
+Patch-ID: bash53-015
+
+Bug-Reported-by: Duncan Roe <[email protected]>
+ Grisha Levit <[email protected]>
+Bug-Reference-ID:
+Bug-Reference-URL:
https://lists.gnu.org/archive/html/bug-bash/2025-09/msg00162.html
+
https://lists.gnu.org/archive/html/bug-bash/2025-10/msg00013.html
+
+Bug-Description:
+
+There are circumstances under which index -1 is used to reference into
+the input buffer used by the `read' builtin.
+
+Patch (apply with `patch -p0'):
+
+*** ../bash-5.3-patched/builtins/read.def Wed Jun 25 15:50:18 2025
+--- builtins/read.def Thu Nov 6 16:51:14 2025
+***************
+*** 539,543 ****
+ protects, then restore input_string so we can use it later */
+ orig_input_string = 0;
+! input_string[i] = '\0'; /* make sure it's terminated */
+ if (i == 0)
+ {
+--- 568,573 ----
+ protects, then restore input_string so we can use it later */
+ orig_input_string = 0;
+! if (i >= 0)
+! input_string[i] = '\0'; /* make sure it's terminated */
+ if (i == 0)
+ {
+***************
+*** 593,598 ****
+
+ ttset = ttattrs;
+! i = silent ? ttfd_cbreak (fd, &ttset) : ttfd_onechar (fd, &ttset);
+! if (i < 0)
+ sh_ttyerror (1);
+ tty_modified = 1;
+--- 623,627 ----
+
+ ttset = ttattrs;
+! if ((silent ? ttfd_cbreak (fd, &ttset) : ttfd_onechar (fd, &ttset)) <
0)
+ sh_ttyerror (1);
+ tty_modified = 1;
+***************
+*** 610,615 ****
+
+ ttset = ttattrs;
+! i = ttfd_noecho (fd, &ttset); /* ttnoecho (); */
+! if (i < 0)
+ sh_ttyerror (1);
+
+--- 639,643 ----
+
+ ttset = ttattrs;
+! if (ttfd_noecho (fd, &ttset) < 0)
+ sh_ttyerror (1);
+
+
+*** ../bash-5.3/patchlevel.h 2020-06-22 14:51:03.000000000 -0400
+--- patchlevel.h 2020-10-01 11:01:28.000000000 -0400
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 14
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 15
+
+ #endif /* _PATCHLEVEL_H_ */
--
2.54.0
