Crash when completing a quoted string ending with '\'

[benoit . boissinot]

Configuration Information [Automatically generated, do not change]:
Machine: i486
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='i486' 
-DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='i486-pc-linux-gnu' 
-DCONF_VENDOR='pc' -DLOCALEDIR='/usr/share/locale' -DPACKAGE='bash' -DSHELL 
-DHAVE_CONFIG_H   -I.  -I../bash -I../bash/include -I../bash/lib   -g -O2 -Wall
uname output: Linux pirzuine 2.6.31-16-generic #52-Ubuntu SMP Thu Dec 3 
22:00:22 UTC 2009 i686 GNU/Linux
Machine Type: i486-pc-linux-gnu

Bash Version: 4.0
Patch Level: 33
Release Status: release

Description:
        Bash crashes when trying to complete a quoted string ending with '\'

Repeat-By:
        Launch bash, type:
        "\
        and press TAB

        See bash crash:
        $ "\
        malloc: unknown:0: assertion botched
        free: start and end chunk sizes differ
        last command: XXXXX
        Aborting...Aborted

Fix:
        The problem is in bash_dequote_filename(). If the string ends with '\',
        then a spurious write of '\0' will happen after the end of the
        allocated area. This will overwrite the guard and make the free() fail.

        Following patch fixes it:
-- bash/bashline.c      2009-12-17 02:13:36.000000000 +0100
+++ /tmp/bashline.c     2009-12-17 02:12:10.000000000 +0100
@@ -3223,9 +3223,10 @@
    else if (quoted == '"' && ((sh_syntaxtab[p[1]] & CBSDQUOTE) == 0))
      *r++ = *p;

-        *r++ = *++p;
-        if (*p == '\0')
+        if (*++p == '\0')
      break;
+
+        *r++ = *p;
    continue;
  }
       /* Close quote. */