Infinite loop in readline's noninc_search

[Eduardo Bustamante]

Ran: bash -c 'read -e' < file # patched read to read from file

file Base64:

L/sFfwh+NRgqGHUcb39AfxsDAAACAIABIf+qANqAABsF6+MAAAA8KDyAAP7/qgDagAAbBevjAAAA
T0wgTYAAAAAnAAIAJgkJAAD+/6r///8JCQkAAAIA5vYJCQl6GzgAvBTgJf22G4A3/xuFhYWFhYVw
hYUXhYWFhYWF/xv/QHyAFAH/G/9AZIAyAQYbGVQE3i8UlhTelmQAGiIuVBAAwxQAABAAGVMkBHt7
e5ZiaXvPLxQCElMbGxAbGlOy/xtVgBQA+BsgRgTeLxSnFAAUGxoiGqEUJIbzlgTe1hQbGjyAAP7/
qvjagAAbBSIagP8JVBMbGxkAAAD/DBSUe3t7e3t7e94vQAAAABuampqampqampqampqampqampoM
FJR/GwIMNRsbEP8AAAAaAGckKOEbIFQm3i8UAAAAABQbGxs4ADQbGiIaoRQkhvMCGxsQVCbeLxSW
BP7WFBsUIhqA/wlUExsbGQAAAP8MFJQUGwIbTiQuJA==


0000000   / 373 005 177  \b   ~   5 030   * 030   u 034   o 177   @ 177
0000020 033 003  \0  \0 002  \0 200 001   ! 377 252  \0 332 200  \0 033
0000040 005 353 343  \0  \0  \0   <   (   < 200  \0 376 377 252  \0 332
0000060 200  \0 033 005 353 343  \0  \0  \0   O   L       M 200  \0  \0
0000100  \0   '  \0 002  \0   &  \t  \t  \0  \0 376 377 252 377 377 377
0000120  \t  \t  \t  \0  \0 002  \0 346 366  \t  \t  \t   z 033   8  \0
0000140 274 024 340   % 375 266 033 200   7 377 033 205 205 205 205 205
0000160 205   p 205 205 027 205 205 205 205 205 205 377 033 377   @   |
0000200 200 024 001 377 033 377   @   d 200   2 001 006 033 031   T 004
0000220 336   / 024 226 024 336 226   d  \0 032   "   .   T 020  \0 303
0000240 024  \0  \0 020  \0 031   S   $ 004   {   {   { 226   b   i   {
0000260 317   / 024 002 022   S 033 033 020 033 032   S 262 377 033   U
0000300 200 024  \0 370 033       F 004 336   / 024 247 024  \0 024 033
0000320 032   " 032 241 024   $ 206 363 226 004 336 326 024 033 032   <
0000340 200  \0 376 377 252 370 332 200  \0 033 005   " 032 200 377  \t
0000360   T 023 033 033 031  \0  \0  \0 377  \f 024 224   {   {   {   {
0000400   {   {   { 336   /   @  \0  \0  \0 033 232 232 232 232 232 232
0000420 232 232 232 232 232 232 232 232 232 232 232 232  \f 024 224 177
0000440 033 002  \f   5 033 033 020 377  \0  \0  \0 032  \0   g   $   (
0000460 341 033       T   & 336   / 024  \0  \0  \0  \0 024 033 033 033
0000500   8  \0   4 033 032   " 032 241 024   $ 206 363 002 033 033 020
0000520   T   & 336   / 024 226 004 376 326 024 033 024   " 032 200 377
0000540  \t   T 023 033 033 031  \0  \0  \0 377  \f 024 224 024 033 002
0000560 033   N   $   .   $
0000565

(gdb) bt
#0  noninc_search (dir=1, pchar=0) at ../../../bash/lib/readline/search.c:377
#1  0x0000561e59f688a2 in rl_noninc_forward_search (count=1, key=110)
at ../../../bash/lib/readline/search.c:396
#2  0x0000561e59f62a47 in _rl_dispatch_subseq (key=110,
map=0x561e5a1d0160 <emacs_meta_keymap>, got_subseq=0)
    at ../../../bash/lib/readline/readline.c:851
#3  0x0000561e59f627be in _rl_dispatch (key=1540448632,
map=0x561e5a1d0160 <emacs_meta_keymap>)
    at ../../../bash/lib/readline/readline.c:797
#4  0x0000561e59f62984 in _rl_dispatch_subseq (key=78,
map=0x561e5a1d0160 <emacs_meta_keymap>, got_subseq=0)
    at ../../../bash/lib/readline/readline.c:840
#5  0x0000561e59f62f0c in _rl_dispatch_subseq (key=27,
map=0x561e5a1cf140 <emacs_standard_keymap>, got_subseq=0)
    at ../../../bash/lib/readline/readline.c:985
#6  0x0000561e59f627be in _rl_dispatch (key=1540448632,
map=0x561e5a1cf140 <emacs_standard_keymap>)
    at ../../../bash/lib/readline/readline.c:797
#7  0x0000561e59f62446 in readline_internal_char () at
../../../bash/lib/readline/readline.c:629
#8  0x0000561e59f6249e in readline_internal_charloop () at
../../../bash/lib/readline/readline.c:656
#9  0x0000561e59f624c2 in readline_internal () at
../../../bash/lib/readline/readline.c:670
#10 0x0000561e59f61edf in readline (prompt=0x561e59fa6e0c "") at
../../../bash/lib/readline/readline.c:374
#11 0x0000561e59f3b40c in edit_line (p=0x561e59fa6e0c "", itext=0x0)
at ../../bash/builtins/../../bash/builtins/read.def:1090
#12 0x0000561e59f3a18e in read_builtin (list=0x0) at
../../bash/builtins/../../bash/builtins/read.def:554
#13 0x0000561e59ed29c7 in execute_builtin (builtin=0x561e59f39435
<read_builtin>, words=0x561e5bcb3648, flags=64, subshell=0)
    at ../bash/execute_cmd.c:4605
#14 0x0000561e59ed3927 in execute_builtin_or_function
(words=0x561e5bcb3648, builtin=0x561e59f39435 <read_builtin>, var=0x0,
    redirects=0x0, fds_to_close=0x561e5bcb2de8, flags=64) at
../bash/execute_cmd.c:5103
#15 0x0000561e59ed22a9 in execute_simple_command
(simple_command=0x561e5bcb2d08, pipe_in=-1, pipe_out=-1, async=0,
    fds_to_close=0x561e5bcb2de8) at ../bash/execute_cmd.c:4391
#16 0x0000561e59ecb9df in execute_command_internal
(command=0x561e5bcb2cc8, asynchronous=0, pipe_in=-1, pipe_out=-1,
    fds_to_close=0x561e5bcb2de8) at ../bash/execute_cmd.c:811
#17 0x0000561e59f32308 in parse_and_execute (string=0x561e5bc9b268
"PATH= read -e", from_file=0x561e59f8f630 "-c", flags=4)
    at ../../bash/builtins/evalstring.c:430
#18 0x0000561e59eb2ce5 in run_one_command (command=0x7ffdabd84755
"PATH= read -e") at ../bash/shell.c:1405
#19 0x0000561e59eb1e04 in main (argc=3, argv=0x7ffdabd834d8,
env=0x7ffdabd834f8) at ../bash/shell.c:718

(gdb) info locals
cxt = 0x561e5bd16108
c = -1
r = 1

It seems like noninc_search doesn't handle EOF (-1) properly, the fix
seems to be:

diff --git a/lib/readline/search.c b/lib/readline/search.c
index 2cbee629..3ae0e1d3 100644
--- a/lib/readline/search.c
+++ b/lib/readline/search.c
@@ -374,7 +374,7 @@ noninc_search (int dir, int pchar)
     {
       c = _rl_search_getchar (cxt);

-      if (c == 0)
+      if (c <= 0)
        break;

       r = _rl_nsearch_dispatch (cxt, c);