Use of TMPDIR crashes bash

[Eric Blake]

Configuration Information:
Machine: i686
OS: cygwin
Compiler: gcc
Compilation CFLAGS:  -DPROGRAM='bash.exe' -DCONF_HOSTTYPE='i686' -
DCONF_OSTYPE='cygwin' -DCONF_MACHTYPE='i686-pc-cygwin' -DCONF_VENDOR='pc' -
DLOCALEDIR='/usr/share/locale' -DPACKAGE='bash' -DSHELL -DHAVE_CONFIG_H -
DRECYCLES_PIDS   -I.  -I/tmp/bash-3.2 -I/tmp/bash-3.2/include -I/tmp/bash-
3.2/lib   -O2
uname output: CYGWIN_NT-5.0 eblake 1.7.0(0.160/4/2) 2006-11-28 21:51 i686 Cygwin
Machine Type: i686-pc-cygwin

Bash Version: 3.2
Patch Level: 5
Release Status: release

Description:
        Two bugs.  First, 'man bash' claims that $TMPDIR is honored for all 
temporary files created by bash.  This is true for temp files used in 
implementing the builtin 'fc' (using the template bash-fcXXXXXX), but not true 
for here-docs (the template sh-thdXXXXXX), or on platforms that 
lack /proc/self/fd, for named pipes (the template sh-npXXXXXX).
    Second, if TMPDIR is set to an invalid directory name longer than PATH_MAX, 
bash corrupts the heap.  True, setting TMPDIR to a non-directory is wrong, but 
bash should gracefully fall back to P_tmpdir (if defined) or "/tmp" in that 
case, rather than crashing.

Repeat-By:
        For an example on Cygwin, where PATH_MAX is 260, this sequence will 
hang bash due to heap corruption:
$ TMPDIR=`perl -e 'print "a"x5000'`
$ fc

Fix:
        In redir.c and subst.c, pass the MT_USETMPDIR flag on to sh_mktmp*.
        In lib/sh/tmpfile.c, use snprintf instead of sprintf, to avoid writing 
past the end of the xmalloc'd array.

-- 
Eric Blake