[PATCH] null pointer deref in bindpwd

[Grisha Levit]

Only triggered by doing something stupid:

bash -c 'declare -n OLDPWD=X[SHLVL=-1]; /; cd /'
bash: line 1: X[SHLVL=-1]: bad array subscript
Segmentation fault: 11

---
diff --git a/builtins/cd.def b/builtins/cd.def
index de123f8b..e3156463 100644
--- a/builtins/cd.def
+++ b/builtins/cd.def
@@ -158,10 +158,9 @@ bindpwd (int no_symlinks)
   pwdvar = get_string_value ("PWD");

   tvar = bind_variable ("OLDPWD", pwdvar, 0);
-  if (tvar && readonly_p (tvar))
+  if (tvar == 0 || readonly_p (tvar))
     r = EXECUTION_FAILURE;
-
-  if (old_anm == 0 && array_needs_making && exported_p (tvar))
+  else if (old_anm == 0 && array_needs_making && exported_p (tvar))
     {
       update_export_env_inplace ("OLDPWD=", 7, pwdvar);
       array_needs_making = 0;