Bash 2.05 'read' mishandles large alarms, sizes on 64-bit hosts

[Paul Eggert]

Configuration Information [Automatically generated, do not change]:
Machine: sparc
OS: solaris2.7
Compiler: cc -xarch=v9
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='sparc' 
-DCONF_OSTYPE='solaris2.7' -DCONF_MACHTYPE='sparc-sun-solaris2.7' 
-DCONF_VENDOR='sun' -DSHELL  -DHAVE_CONFIG_H  -D_LARGEFILE_SOURCE 
-D_FILE_OFFSET_BITS=64 -D_LARGEFILE64_SOURCE -I.  -I.. -I../include -I../lib 
-I/tmp/prefix/include -g
uname output: SunOS sic.twinsun.com 5.7 Generic_106541-15 sun4u sparc 
SUNW,UltraSPARC-IIi-Engine
Machine Type: sparc-sun-solaris2.7

Bash Version: 2.05
Patch Level: 0
Release Status: release

Description:
        The 'read' builtin mishandles alarms larger than 2**31.
        Such alarms can occur on 64-bit hosts.  'read' also
        mishandles read buffer sizes larger than 2**31.

Repeat-By:
        $ read -t 4294967296 foo
        $ echo $?
        1

        The 'read -t 4294967296' silently fails, as if it had been a
        'read -t 0 foo'.  It should instead report that the timeout is
        invalid.


Fix:

2001-04-29  Paul Eggert  <eggert@twinsun.com>

        * builtins/read.def (read_builtin):
        Alarm argument is unsigned, not int.
        Check for alarm timeout that does not fit into 'unsigned'.
        Check for ncharsval that does not fit into 'int'.

===================================================================
RCS file: builtins/read.def,v
retrieving revision 2.5
retrieving revision 2.5.0.1
diff -pu -r2.5 -r2.5.0.1
--- builtins/read.def   2001/02/14 22:10:46     2.5
+++ builtins/read.def   2001/04/30 01:44:39     2.5.0.1
@@ -120,7 +120,8 @@ read_builtin (list)
   register char *varname;
   int size, i, pass_next, saw_escape, eof, opt, retval, code;
   int input_is_tty, input_is_pipe, unbuffered_read;
-  int raw, edit, tmout, nchars, silent;
+  int raw, edit, nchars, silent, have_timeout;
+  unsigned tmout;
   long timeoutval, ncharsval;
   char c;
   char *input_string, *orig_input_string, *ifs_chars, *prompt, *arrayname;
@@ -145,7 +146,8 @@ read_builtin (list)
   rlind = 0;
 #endif
 
-  tmout = -1;          /* no timeout */
+  tmout = 0;
+  have_timeout = 0;
   nchars = input_is_tty = input_is_pipe = unbuffered_read = 0;
   delim = '\n';                /* read until newline */
 
@@ -175,17 +177,21 @@ read_builtin (list)
 #endif
        case 't':
          code = legal_number (list_optarg, &timeoutval);
-         if (code == 0 || timeoutval < 0)
+         if (code == 0 || timeoutval < 0
+             || timeoutval != (unsigned) timeoutval)
            {
              builtin_error ("%s: invalid timeout specification", list_optarg);
              return (EXECUTION_FAILURE);
            }
          else
-           tmout = timeoutval;
+           {
+             tmout = timeoutval;
+             have_timeout = 1;
+           }
          break;
        case 'n':
          code = legal_number (list_optarg, &ncharsval);
-         if (code == 0 || ncharsval < 0)
+         if (code == 0 || ncharsval < 0 || ncharsval != (int) ncharsval)
            {
              builtin_error ("%s: invalid number specification", list_optarg);
              return (EXECUTION_FAILURE);
@@ -204,7 +210,7 @@ read_builtin (list)
   list = loptend;
 
   /* `read -t 0 var' returns failure immediately. */
-  if (tmout == 0)
+  if (have_timeout && tmout == 0)
     return (EXECUTION_FAILURE);
 
   /* IF IFS is unset, we use the default of " \t\n". */
@@ -250,7 +256,7 @@ read_builtin (list)
       /* Turn off the timeout if stdin is a regular file (e.g. from
         input redirection). */
       if ((fstat (0, &tsb) < 0) || S_ISREG (tsb.st_mode))
-       tmout = -1;
+       tmout = 0;
     }
 
   if (tmout > 0)