patchlevel.h | 2 1 + 1 - 0 !
test.c | 5 3 + 2 - 0 !
2 files changed, 4 insertions(+), 3 deletions(-)

A missing check for a valid option prevented `test -R' from working.  There
is another problem that causes bash to look up the wrong variable name when
processing the argument to `test -R'.

Patch (apply with `patch -p0'):

patchlevel.h | 2 1 + 1 - 0 !
trap.c | 6 4 + 2 - 0 !
2 files changed, 5 insertions(+), 3 deletions(-)

A change to save state while running the DEBUG trap caused pipelines to hang
on systems which need process group synchronization while building pipelines.

Patch (apply with `patch -p0'):

lib/readline/readline.c | 3 2 + 1 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
2 files changed, 3 insertions(+), 2 deletions(-)

When in callback mode, some readline commands can cause readline to seg
fault by passing invalid contexts to callback functions.

Patch (apply with `patch -p0'):

lib/readline/readline.c | 2 1 + 1 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
2 files changed, 2 insertions(+), 2 deletions(-)

The `.' command in vi mode cannot undo multi-key commands beginning with
`c', `d', and `y' (command plus motion specifier).

Patch (apply with `patch -p0'):

parse.y | 2 1 + 1 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
y.tab.c | 2 1 + 1 - 0 !
3 files changed, 3 insertions(+), 3 deletions(-)

When in Posix mode, bash did not correctly interpret the ANSI-C-style
$'...' quoting mechanism when performing pattern substitution word
expansions within double quotes.

Patch (apply with `patch -p0'):

jobs.c | 2 1 + 1 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
2 files changed, 2 insertions(+), 2 deletions(-)

A shell that started with job control active but was not interactive left
the terminal in the wrong process group when exiting, causing its parent
shell to get a stop signal when it attempted to read from the terminal.

Patch (apply with `patch -p0'):

arrayfunc.c | 5 5 + 0 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
2 files changed, 6 insertions(+), 1 deletion(-)

Using compound assignments for associative arrays like

assoc=( [x]= [y]=bar )

left the value corresponding to the key `x' NULL.  This caused subsequent
lookups to interpret it as unset.

Patch (apply with `patch -p0'):

lib/glob/glob.c | 59 34 + 25 - 0 !
lib/glob/gmisc.c | 1 1 + 0 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
3 files changed, 36 insertions(+), 26 deletions(-)

Some extended glob patterns incorrectly matched filenames with a leading
dot, regardless of the setting of the `dotglob' option.

Patch (apply with `patch -p0'):

parse.y | 2 1 + 1 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
y.tab.c | 2 1 + 1 - 0 !
3 files changed, 3 insertions(+), 3 deletions(-)

There is a problem with unsigned sign extension when attempting to reallocate
the input line when it is fewer than 3 characters long and there has been a
history expansion.  The sign extension causes the shell to not reallocate the
line, which results in a segmentation fault when it writes past the end.

externs.h | 1 1 + 0 - 0 !
lib/sh/shquote.c | 14 14 + 0 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
pcomplete.c | 32 31 + 1 - 0 !
4 files changed, 47 insertions(+), 2 deletions(-)

Patch (apply with `patch -p0'):

This patch changes the behavior of programmable completion to compensate
for two assumptions made by the bash-completion package.  Bash-4.3 changed
to dequote the argument to programmable completion only under certain
circumstances, to make the behavior of compgen more consistent when run
from the command line -- closer to the behavior when run by a shell function
run as part of programmable completion.  Bash-completion can pass quoted
arguments to compgen when the original word to be completed was not quoted,
expecting programmable completion to dequote the word before attempting
completion.

This patch fixes two cases:

1.  An empty string that bash-completion passes to compgen as a quoted null
    string ('').

2.  An unquoted word that bash-completion quotes using single quotes or
    backslashes before passing it to compgen.

In these cases, since readline did not detect a quote character in the original
word to be completed, bash-4.3 

lib/readline/display.c | 3 2 + 1 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
2 files changed, 3 insertions(+), 2 deletions(-)

The signal handling changes to bash and readline (to avoid running any code
in a signal handler context) cause the cursor to be placed on the wrong
line of a multi-line command after a ^C interrupts editing.

jobs.c | 1 1 + 0 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
2 files changed, 2 insertions(+), 1 deletion(-)

When a SIGCHLD trap runs a command containing a shell builtin while
a script is running `wait' to wait for all running children to complete,
the SIGCHLD trap will not be run once for each child that terminates.

Patch (apply with `patch -p0'):

lib/readline/display.c | 9 7 + 2 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
2 files changed, 8 insertions(+), 3 deletions(-)

Using reverse-i-search when horizontal scrolling is enabled does not redisplay
the entire line containing the successful search results.

Patch (apply with `patch -p0'):

patchlevel.h | 2 1 + 1 - 0 !
subst.c | 32 32 + 0 - 0 !
2 files changed, 33 insertions(+), 1 deletion(-)

Under certain circumstances, $@ is expanded incorrectly in contexts where
word splitting is not performed.

Patch (apply with `patch -p0'):

bashline.c | 11 9 + 2 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
2 files changed, 10 insertions(+), 3 deletions(-)

When completing directory names, the directory name is dequoted twice.
This causes problems for directories with single and double quotes in
their names.

Patch (apply with `patch -p0'):

lib/glob/glob.c | 19 18 + 1 - 0 !
lib/glob/gmisc.c | 33 33 + 0 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
3 files changed, 52 insertions(+), 2 deletions(-)

An extended glob pattern containing a slash (`/') causes the globbing code
to misinterpret it as a directory separator.

Patch (apply with `patch -p0'):

patchlevel.h | 2 1 + 1 - 0 !
variables.c | 5 1 + 4 - 0 !
2 files changed, 2 insertions(+), 5 deletions(-)

The code that creates local variables should not clear the `invisible'
attribute when returning an existing local variable.  Let the code that
actually assigns a value clear it.

Patch (apply with `patch -p0'):

arrayfunc.c | 1 1 + 0 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
2 files changed, 2 insertions(+), 1 deletion(-)

When assigning an array variable using the compound assignment syntax,
but using `declare' with the rhs of the compound assignment quoted, the
shell did not mark the variable as visible after successfully performing
the assignment.

Patch (apply with `patch -p0'):

builtins/read.def | 7 6 + 1 - 0 !
lib/readline/input.c | 8 8 + 0 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
3 files changed, 15 insertions(+), 2 deletions(-)

The -t timeout option to `read' does not work when the -e option is used.

Patch (apply with `patch -p0'):

parse.y | 4 3 + 1 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
shell.h | 3 2 + 1 - 0 !
y.tab.c | 4 3 + 1 - 0 !
4 files changed, 9 insertions(+), 4 deletions(-)

When PS2 contains a command substitution, here-documents entered in an
interactive shell can sometimes cause a segmentation fault.

Patch (apply with `patch -p0'):

lib/readline/misc.c | 2 1 + 1 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
2 files changed, 2 insertions(+), 2 deletions(-)

When the readline `revert-all-at-newline' option is set, pressing newline
when the current line is one retrieved from history results in a double free
and a segmentation fault.

Patch (apply with `patch -p0'):

execute_cmd.c | 11 10 + 1 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
2 files changed, 11 insertions(+), 2 deletions(-)

Using nested pipelines within loops with the `lastpipe' option set can result
in a segmentation fault.

Patch (apply with `patch -p0'):

patchlevel.h | 2 1 + 1 - 0 !
subst.c | 12 9 + 3 - 0 !
subst.h | 2 1 + 1 - 0 !
3 files changed, 11 insertions(+), 5 deletions(-)

Bash does not correctly parse process substitution constructs that contain
unbalanced parentheses as part of the contained command.

Patch (apply with `patch -p0'):

patchlevel.h | 2 1 + 1 - 0 !
subst.c | 8 7 + 1 - 0 !
2 files changed, 8 insertions(+), 2 deletions(-)

Indirect variable references do not work correctly if the reference
variable expands to an array reference using a subscript other than 0
(e.g., foo='bar[1]' ; echo ${!foo}).

Patch (apply with `patch -p0'):

builtins/common.h | 2 2 + 0 - 0 !
builtins/evalstring.c | 11 11 + 0 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
subst.c | 4 3 + 1 - 0 !
variables.c | 16 5 + 11 - 0 !
5 files changed, 22 insertions(+), 13 deletions(-)

Under certain circumstances, bash will execute user code while processing the
environment for exported function definitions.

parse.y | 2 2 + 0 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
y.tab.c | 3 2 + 1 - 0 !
3 files changed, 5 insertions(+), 2 deletions(-)

Under certain circumstances, bash can incorrectly save a lookahead character and
return it on a subsequent call, even when reading a new line.

patchlevel.h | 2 1 + 1 - 0 !
variables.c | 80 60 + 20 - 0 !
2 files changed, 61 insertions(+), 21 deletions(-)

This patch changes the encoding bash uses for exported functions to avoid
clashes with shell variables and to avoid depending only on an environment
variable's contents to determine whether or not to interpret it as a shell
function.

parse.y | 36 28 + 8 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
y.tab.c | 399 210 + 189 - 0 !
3 files changed, 239 insertions(+), 198 deletions(-)

There are two local buffer overflows in parse.y that can cause the shell
to dump core when given many here-documents attached to a single command
or many nested loops.

copy_cmd.c | 2 1 + 1 - 0 !
make_cmd.c | 1 1 + 0 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
3 files changed, 3 insertions(+), 2 deletions(-)

When bash is parsing a function definition that contains a here-document
delimited by end-of-file (or end-of-string), it leaves the closing delimiter
uninitialized.  This can result in an invalid memory access when the parsed
function is later copied.

builtins/evalstring.c | 28 22 + 6 - 0 !
parse.y | 14 12 + 2 - 0 !
patchlevel.h | 2 1 + 1 - 0 !
shell.h | 2 2 + 0 - 0 !
y.tab.c | 336 173 + 163 - 0 !
5 files changed, 210 insertions(+), 172 deletions(-)

A combination of nested command substitutions and function importing from
the environment can cause bash to execute code appearing in the environment
variable value following the function definition.

support/bashbug.sh | 1 1 + 0 - 0 !
1 file changed, 1 insertion(+)

---

config-bot.h | 2 1 + 1 - 0 !
config-top.h | 8 4 + 4 - 0 !
2 files changed, 5 insertions(+), 5 deletions(-)

---

examples/loadables/README | 3 3 + 0 - 0 !
1 file changed, 3 insertions(+)

---

doc/bash.1 | 3 3 + 0 - 0 !
1 file changed, 3 insertions(+)

---

doc/bash.1 | 4 3 + 1 - 0 !
1 file changed, 3 insertions(+), 1 deletion(-)

---

doc/bash.1 | 20 15 + 5 - 0 !
1 file changed, 15 insertions(+), 5 deletions(-)

---

doc/bash.1 | 3 3 + 0 - 0 !
1 file changed, 3 insertions(+)

---

doc/bash.1 | 4 4 + 0 - 0 !
1 file changed, 4 insertions(+)

---

builtins/test.def | 3 3 + 0 - 0 !
1 file changed, 3 insertions(+)

---

builtins/test.def | 3 3 + 0 - 0 !
doc/bash.1 | 4 4 + 0 - 0 !
doc/bashref.texi | 4 4 + 0 - 0 !
3 files changed, 11 insertions(+)

---

shell.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

---

doc/rbash.1 | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

---

bashline.c | 4 2 + 2 - 0 !
builtins/fc.def | 4 2 + 2 - 0 !
2 files changed, 4 insertions(+), 4 deletions(-)

---

subst.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

---

config-bot.h | 3 3 + 0 - 0 !
1 file changed, 3 insertions(+)

---

input.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

---

doc/bash.1 | 4 4 + 0 - 0 !
doc/bashref.texi | 3 3 + 0 - 0 !
2 files changed, 7 insertions(+)

---

examples/startup-files/Bash_aliases | 6 3 + 3 - 0 !
1 file changed, 3 insertions(+), 3 deletions(-)

---

doc/Makefile.in | 4 2 + 2 - 0 !
1 file changed, 2 insertions(+), 2 deletions(-)

---

lib/sh/oslib.c | 4 2 + 2 - 0 !
1 file changed, 2 insertions(+), 2 deletions(-)

---