Bash Segfaults with menu-complete and negative argument

[Jeenu V]

Configuration Information [Automatically generated, do not change]:
Machine: i486
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='i486'
-DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='i486-pc-linux-gnu'
-DCONF_VENDOR='pc' -DLOCALEDIR='/usr/share/locale' -DPACKAGE='bash'
-DSHELL -DHAVE_CONFIG_H   -I.  -I../bash -I../bash/include
-I../bash/lib   -g -O2 -Wall
uname output: Linux l-blr-esd 2.6.32-24-generic #43-Ubuntu SMP Thu Sep
16 14:17:33 UTC 2010 i686 GNU/Linux
Machine Type: i486-pc-linux-gnu

Bash Version: 4.1
Patch Level: 5
Release Status: release

Description:
        I've mapped TAB key to menu-complete readline function. If press TAB
with a negative argument, thus requesting a backward menu completion,
Bash hits Segfault if the negative argument is greater than the number
of completion candidates plus one.

Repeat-By:
        Create 3 directories aa, ab and ac. Type 'cd a' (without quotes). Now
press TAB with argument -4 and Bash crashes. If there's another
directory ad, you'd had to enter -5 as argument

Fix:
        Probably it's buffer overflow.

-- 
Jeenu