[ksh/f16] fix: IFS manipulation in a function can cause crash

[Michal Hlavinka]

commit 7e0932a9cbbedb86112ad2412315286abf96dc39
Author: Michal Hlavinka <mhlavink at redhat.com>
Date:   Wed Aug 3 22:20:22 2011 +0200

    fix: IFS manipulation in a function can cause crash

 ksh-20110630-ifsfix.patch |   23 +++++++++++++++++++++++
 ksh.spec                  |    9 ++++++++-
 2 files changed, 31 insertions(+), 1 deletions(-)
---
diff --git a/ksh-20110630-ifsfix.patch b/ksh-20110630-ifsfix.patch
new file mode 100644
index 0000000..4393005
--- /dev/null
+++ b/ksh-20110630-ifsfix.patch
@@ -0,0 +1,23 @@
+diff -up ksh-20110630/src/cmd/ksh93/sh/subshell.c.ifsfix ksh-20110630/src/cmd/ksh93/sh/subshell.c
+--- ksh-20110630/src/cmd/ksh93/sh/subshell.c.ifsfix	2011-06-09 15:16:19.000000000 +0200
++++ ksh-20110630/src/cmd/ksh93/sh/subshell.c	2011-08-03 07:58:55.749400810 +0200
+@@ -304,7 +304,7 @@ static void nv_restore(struct subshell *
+ 	register Namval_t *mp, *np;
+ 	const char *save = sp->shpwd;
+ 	Namval_t	*mpnext;
+-	int		flags;
++	int		flags,nofree;
+ 	sp->shpwd = 0;	/* make sure sh_assignok doesn't save with nv_unset() */
+ 	for(lp=sp->svar; lp; lp=lq)
+ 	{
+@@ -327,7 +327,9 @@ static void nv_restore(struct subshell *
+ 		nv_setsize(mp,nv_size(np));
+ 		if(!(flags&NV_MINIMAL))
+ 			mp->nvenv = np->nvenv;
+-		mp->nvfun = np->nvfun;
++		nofree = mp->nvfun?mp->nvfun->nofree:0;
++		if((mp->nvfun = np->nvfun) && nofree)
++			mp->nvfun->nofree = nofree;
+ 		if(nv_isattr(np,NV_IDENT))
+ 		{
+ 			nv_offattr(np,NV_IDENT);
diff --git a/ksh.spec b/ksh.spec
index 7907769..ee61daa 100644
--- a/ksh.spec
+++ b/ksh.spec
@@ -6,7 +6,7 @@ URL:          http://www.kornshell.com/
 Group:        System Environment/Shells
 License:      CPL
 Version:      20110630
-Release:      1%{?dist}
+Release:      2%{?dist}
 Source0:      http://www.research.att.com/~gsf/download/tgz/ast-ksh.%{releasedate}.tgz
 Source1:      http://www.research.att.com/~gsf/download/tgz/INIT.%{releasedate}.tgz
 Source3:      kshrc.rhs
@@ -20,6 +20,9 @@ Patch1:       ksh-20070328-builtins.patch
 #fix regression test suite to be usable during packagebuild - Fedora/RHEL specific
 Patch2:       ksh-20100826-fixregr.patch
 
+# for ksh < 2011-08-03
+Patch3:       ksh-20110630-ifsfix.patch
+
 BuildRoot:    %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Conflicts:    pdksh
 Requires: coreutils, glibc-common, diffutils
@@ -40,6 +43,7 @@ with "sh" (the Bourne Shell).
 %setup -q -T -D -a 1
 %patch1 -p1 -b .builtins
 %patch2 -p1 -b .fixregr
+%patch3 -p1 -b .ifsfix
 
 #/dev/fd test does not work because of mock
 sed -i 's|ls /dev/fd|ls /proc/self/fd|' src/cmd/ksh93/features/options
@@ -120,6 +124,9 @@ fi
     rm -rf $RPM_BUILD_ROOT
 
 %changelog
+* Wed Aug 03 2011 Michal Hlavinka <mhlavink at redhat.com> - 20110630-2
+- fix: IFS manipulation in a function can cause crash
+
 * Fri Jul 01 2011 Michal Hlavinka <mhlavink at redhat.com> - 20110630-1
 - ksh updated to 2011-06-30