Segfault in save_bash_input. Array index is out of a range.

[Alexey Makhalov]

I have met situation when nfd(returned by fcntl) is 217, but nbuffers is only 25

  if (buffers[nfd])
    {
      /* What's this?  A stray buffer without an associated open file
         descriptor?  Free up the buffer and report the error. */
      internal_error (_("save_bash_input: buffer already exists for new fd %d"), nfd);
      free_buffered_stream (buffers[nfd]);
    }

and free_buffered_stream() causes a segfault.

I added extra comparison nfd < nbuffers - it works for me.
Why do we need this check? Does stray buffer happen, when nfd is in a range [0,nbuffers)?

Patch is attached.

Thanks,

Alexey

fix-save_bash_input-segfault.patch
Description: Text Data