PS1 \W crash with PWD unset

[Tim Waugh]

Configuration Information [Automatically generated, do not change]:
Machine: i386
OS: linux-gnu
Compiler: i386-redhat-linux-gcc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='i386' 
-DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='i386-redhat-linux-gnu' 
-DCONF_VENDOR='redhat' -DLOCALEDIR='/usr/share/locale' -DPACKAGE='bash' -DSHELL 
-DHAVE_CONFIG_H  -I.  -I. -I./include -I./lib  -D_GNU_SOURCE 
-D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -Wall -g -pipe 
-Wp,-D_FORTIFY_SOURCE=2 -m32 -march=i386 -mtune=pentium4
uname output: Linux gene.surrey.redhat.com 2.6.11-1.1176_FC4 #1 Mon Mar 7 
02:10:55 EST 2005 i686 i686 i386 GNU/Linux
Machine Type: i386-redhat-linux-gnu

Bash Version: 3.0
Patch Level: 16
Release Status: release

Description:
        If PS1 contains '\W' but PWD becomes unset, for instance by
        'unset PWD', bash segfaults.  This is because the code
        handling \W uses the result of get_string_value even if it is
        NULL.

        However, earlier in the code it does check for NULL and takes
        appropriate action, so a guaranteed non-NULL version of the
        result is already available.  The fix is to use it.

Repeat-By:
        PS1='\W'
        unset PWD

Fix:

--- bash-3.0/parse.y.pwd        2005-03-15 14:22:36.000000000 +0000
+++ bash-3.0/parse.y    2005-03-15 14:22:37.000000000 +0000
@@ -4103,7 +4103,7 @@
 #define ROOT_PATH(x)   ((x)[0] == '/' && (x)[1] == 0)
 #define DOUBLE_SLASH_ROOT(x)   ((x)[0] == '/' && (x)[1] == '/' && (x)[2] == 0)
                /* Abbreviate \W as ~ if $PWD == $HOME */
-               if (c == 'W' && (((t = get_string_value ("HOME")) == 0) || 
STREQ (t, temp) == 0))
+               if (c == 'W' && (((t = get_string_value ("HOME")) == 0) || 
STREQ (t, t_string) == 0))
                  {
                    if (ROOT_PATH (t_string) == 0 && DOUBLE_SLASH_ROOT 
(t_string) == 0)
                      {