import CS ksh-20120801-267.el8

SOURCES/ksh-1.0.7-history-trim.patch

@@ -0,0 +1,102 @@
+From 2075b2b96208ac8b989ca316dcdd674c3f488e2b Mon Sep 17 00:00:00 2001
+From: Martijn Dekker <martijn@inlv.org>
+Date: Thu, 28 Dec 2023 04:02:28 +0000
+Subject: [PATCH] Subject: [PATCH] Fix crash on failure to trim ~/.sh_history
+
+@vmihalko writes:
+> We were able to reproduce an old issue mentioned in
+> https://bugzilla.redhat.com/show_bug.cgi?id=1885399 using the
+> latest version of ksh. The corresponding code has not changed
+> much in the past few years.
+>
+> To provide further explanation, the problem arises when a user's
+> .sh_history file grows to a size that triggers the hist_trim
+> function, but the user lacks (after the creation of .sh_history)
+> the necessary write permissions to their $HOME directory. As a
+> result, ksh becomes stuck in a recursive loop between the
+> sh_histinit(src/cmd/ksh93/edit/history.c#L203) function and the
+> hist_trim(src/cmd/ksh93/edit/history.c#L417) function.
+>
+> Conditions for reproduction:
+>
+> 1. The size of the .sh_history file is larger than the HIST_MAX
+>    limit. (src/cmd/ksh93/edit/history.c, line 325)
+> 2. .sh_history file has not been changed in the HIST_RECENT
+>    seconds (src/cmd/ksh93/edit/history.c, line 406)
+> 3. The user does not have permission to write to the $HOME
+>    directory.
+
+src/cmd/ksh93/edit/history.c: hist_trim():
+- Print a warning and return if unlink(2) fails. The warning tells
+  the user to check the history file's parent directory is
+  writable. This is the best I realistically do for now, because
+  this function's basic method assumes a writable parent directory.
+- The temp file fallback is deleted because it's fundamentally
+  flawed: it assumes the temp file is made on the same volume as
+  the history file and can simply be rename(2)'d in place. Even
+  on systems where this is the case, it doesn't appear to be
+  working correctly, but this is not worth looking into.
+
+Resolves: https://github.com/ksh93/ksh/issues/695
+---
+ src/cmd/ksh93/edit/history.c | 34 ++++------------------------------
+ 1 file changed, 4 insertions(+), 30 deletions(-)
+
+diff --git a/src/cmd/ksh93/edit/history.c b/src/cmd/ksh93/edit/history.c
+index 1f6cd7c..0ed8e8a 100644
+--- a/src/cmd/ksh93/edit/history.c
++++ b/src/cmd/ksh93/edit/history.c
+@@ -461,34 +461,13 @@ static History_t* hist_trim(History_t *hp, int n)
+ 	register char *cp;
+ 	register int incmd=1, c=0;
+ 	register History_t *hist_new, *hist_old = hp;
+-	char *buff, *endbuff, *tmpname=0;
++	char *buff, *endbuff;
+ 	off_t oldp,newp;
+ 	struct stat statb;
+-	unlink(hist_old->histname);
+-	if(access(hist_old->histname,F_OK) >= 0)
++	if(unlink(hist_old->histname) < 0)
+ 	{
+-		/* The unlink can fail on windows 95 */
+-		int fd;
+-		char *last, *name=hist_old->histname;
+-		close(sffileno(hist_old->histfp));
+-		tmpname = (char*)malloc(strlen(name)+14);
+-		if(last = strrchr(name,'/'))
+-		{
+-			*last = 0;
+-			pathtmp(tmpname,name,"hist",NIL(int*));
+-			*last = '/';
+-		}
+-		else
+-			pathtmp(tmpname,".","hist",NIL(int*));
+-		if(rename(name,tmpname) < 0)
+-		{
+-			free(tmpname);
+-			tmpname = name;
+-		}
+-		fd = open(tmpname,O_RDONLY);
+-		sfsetfd(hist_old->histfp,fd);
+-		if(tmpname==name)
+-			tmpname = 0;
++                errormsg(SH_DICT,ERROR_warn(0),"cannot trim history file %s; make sure parent directory is writable",hist_old->histname);
++                return hist_ptr = hist_old;
+ 	}
+ 	hist_ptr = 0;
+ 	if(fstat(sffileno(hist_old->histfp),&statb)>=0)
+@@ -543,11 +522,6 @@ static History_t* hist_trim(History_t *hp, int n)
+ 	}
+ 	hist_cancel(hist_new);
+ 	sfclose(hist_old->histfp);
+-	if(tmpname)
+-	{
+-		unlink(tmpname);
+-		free(tmpname);
+-	}
+ 	free((char*)hist_old);
+ 	return hist_ptr = hist_new;
+ }
+-- 
+2.42.0
+

SOURCES/ksh-20120801-manfix4.patch

@@ -1,12 +0,0 @@
-diff -up ksh-20120801/src/cmd/ksh93/sh.1.manfix4 ksh-20120801/src/cmd/ksh93/sh.1
---- ksh-20120801/src/cmd/ksh93/sh.1.manfix4	2014-05-22 12:04:51.593750721 +0200
-+++ ksh-20120801/src/cmd/ksh93/sh.1	2014-05-22 12:05:32.561556452 +0200
-@@ -4147,7 +4147,7 @@ command are ignored if the command is fo
- .B &
- and the
- .B monitor
--option is not active.
-+option is active.
- Otherwise, signals have the values
- inherited by the shell from its parent
- (but see also

SOURCES/ksh-20120801-segfault-cd-paths.patch

@@ -0,0 +1,55 @@
+From 035a4cb3f453271b7ae63bcb53a7963b8dbe4c41 Mon Sep 17 00:00:00 2001
+From: Anuradha Weeraman <anuradha@weeraman.com>
+Date: Thu, 2 Jul 2020 18:29:07 -0400
+Subject: [PATCH] Fix segfault if $PATH contains a .paths directory (#55)
+
+ksh crashed if it encountered a .paths directory in any of the
+directories in $PATH.
+
+Ref: https://bugs.launchpad.net/ubuntu/+source/ksh/+bug/1534855
+
+src/cmd/ksh93/sh/path.c: path_chkpaths():
+- Refuse to read .paths if it's not a regular file
+  or a symlink to a regular file.
+
+Upstream-commit: 035a4cb3f453271b7ae63bcb53a7963b8dbe4c41
+Cherry-picked-by: Lukáš Zaoral <lzaoral@redhat.com>
+---
+ src/cmd/ksh93/sh/path.c         | 4 ++++
+ src/cmd/ksh93/tests/path.sh     | 9 +++++++++
+ 2 files changed, 13 insertions(+)
+
+diff --git a/src/cmd/ksh93/sh/path.c b/src/cmd/ksh93/sh/path.c
+index 213a2a6c7375..25ade4073dad 100644
+--- a/src/cmd/ksh93/sh/path.c
++++ b/src/cmd/ksh93/sh/path.c
+@@ -1507,6 +1507,10 @@ static int path_chkpaths(Shell_t *shp,Pathcomp_t *first, Pathcomp_t* old,Pathcom
+ 	if((fd=open(stakptr(offset),O_RDONLY))>=0)
+ 	{
+ 		fstat(fd,&statb);
++		if (!S_ISREG(statb.st_mode)) {
++			close(fd);
++			return 0;
++		}
+ 		n = statb.st_size;
+ 		stakseek(offset+pp->len+n+2);
+ 		sp = stakptr(offset+pp->len);
+diff --git a/src/cmd/ksh93/tests/path.sh b/src/cmd/ksh93/tests/path.sh
+index c9d8d2485e28..9725c74e31ea 100755
+--- a/src/cmd/ksh93/tests/path.sh
++++ b/src/cmd/ksh93/tests/path.sh
+@@ -408,5 +408,14 @@ END
+ END
+ ) || err_exit '${.sh.xxx} variables causes cat not be found'
+ 
++# ksh segfaults if $PATH contains a .paths directory
++mkdir -p $tmp/paths-dir-crash/
++cat > $tmp/paths-dir-crash/run.sh <<- EOF
++mkdir -p $tmp/paths-dir-crash/.paths
++export PATH=$tmp/paths-dir-crash:$PATH
++print ok
++EOF
++[[ $($SHELL $tmp/paths-dir-crash/run.sh 2>/dev/null) == ok ]] || err_exit "ksh crashes if PATH contains a .paths directory"
++
+ exit $((Errors<125?Errors:125))
+ 

SOURCES/ksh-20120801-segfault-strdup.patch

@@ -0,0 +1,53 @@
+From 9eb8532ccacf1cfdb7ba18f51eba68776852ef7c Mon Sep 17 00:00:00 2001
+From: Vincent Mihalkovic <vmihalko@redhat.com>
+Date: Thu, 8 Feb 2024 22:10:58 +0100
+Subject: [PATCH] Re-fix use of strdup on a NULL pointer (re: 9a9da2c2) (#718)
+
+Thank you @lzaoral for debugging this issue and creating this
+reproducer:
+
+$ tty   # check that the shell is connected to a pseudoterminal
+/dev/pts/4
+$ mkdir /var/tmp/chroottest
+$ dnf --releasever=39 --installroot=/var/tmp/chroottest install ksh
+$ echo "/dev/udp/127.0.0.1/514;0;104" |
+        sudo tee /var/tmp/chroottest/etc/ksh_audit
+$ sudo chroot /var/tmp/chroottest /bin/ksh -lic 'exit 0'
+(ksh segfaults)
+
+Analysis: On Linux, ttyname(3)[*] may fail if:
+
+* EBADF  Bad file descriptor.
+* ENODEV fd refers to a slave pseudoterminal device but the
+         corresponding pathname could not be found [...].
+* ENOTTY fd does not refer to a terminal device.
+
+Calling isatty(3) before ttyname(3) only prevents the first and
+third cases.
+
+src/cmd/ksh93/edit/history.c: sh_histinit():
+- To catch the second case, let's call ttyname(2) directly, check
+  for NULL and remove the redundant isatty() call.
+
+[*] https://man7.org/linux/man-pages/man3/ttyname.3.html
+---
+ src/cmd/ksh93/edit/history.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/cmd/ksh93/edit/history.c b/src/cmd/ksh93/edit/history.c
+index de5e4a8..222d4bc 100644
+--- a/src/cmd/ksh93/edit/history.c
++++ b/src/cmd/ksh93/edit/history.c
+@@ -395,7 +395,8 @@ retry:
+ 			if(fd>=0)
+ 			{
+ 				fcntl(fd,F_SETFD,FD_CLOEXEC);
+-				hp->tty = strdup(ttyname(2));
++				const char* tty = ttyname(2);
++				hp->tty = strdup(tty?tty:"notty");
+ 				hp->auditfp = sfnew((Sfio_t*)0,NULL,-1,fd,SF_WRITE);
+ 			}
+ 		}
+-- 
+2.43.0
+

SOURCES/ksh-20120801-set+r-fix.patch

@@ -0,0 +1,57 @@
+From 74b4162178c8a2347491b9fd3a22d8e6e1b7e831 Mon Sep 17 00:00:00 2001
+From: Johnothan King <johnothanking@protonmail.com>
+Date: Wed, 10 Jun 2020 10:19:41 -0700
+Subject: [PATCH] Fix `set +r` so that it cannot unset the restricted option
+
+The ksh man page documents that the restricted option cannot be
+unset once it is set, which means `set +r` should be invalid.
+While this was true for `set +o restricted`, `set +r` was causing
+the restricted option to be unset. The fix for this problem comes
+from one of Solaris' patches, which adds an error check to prevent
+this behavior.
+
+Solaris' patch:
+https://github.com/oracle/solaris-userland/blob/master/components/ksh93/patches/020-CR6919590.patch
+
+src/cmd/ksh93/sh/args.c:
+ - Add an error check to stop `set +r` from unsetting the
+   restricted option.
+
+src/cmd/ksh93/tests/restricted.sh:
+ - Add two regression tests to make sure the restricted option
+   cannot be unset.
+
+(cherry picked from commit bef4fee404d8e24b38fce66420c14a39ac4a123e)
+---
+ src/cmd/ksh93/sh/args.c           | 2 ++
+ src/cmd/ksh93/tests/restricted.sh | 6 ++++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/src/cmd/ksh93/sh/args.c b/src/cmd/ksh93/sh/args.c
+index a4a11012d90a..70bcabea680d 100644
+--- a/src/cmd/ksh93/sh/args.c
++++ b/src/cmd/ksh93/sh/args.c
+@@ -302,6 +302,8 @@ int sh_argopts(int argc,register char *argv[], void *context)
+ 		}
+ 		else
+ 		{
++			if ((o == SH_RESTRICTED) && sh_isoption(SH_RESTRICTED))
++				errormsg(SH_DICT,ERROR_exit(1),e_restricted,"r"); /* set -r cannot be unset */
+ 			if(o==SH_XTRACE)
+ 				trace = 0;
+ 			off_option(&newflags,o);
+diff --git a/src/cmd/ksh93/tests/restricted.sh b/src/cmd/ksh93/tests/restricted.sh
+index abf33cc82c04..eb32c01bb62e 100755
+--- a/src/cmd/ksh93/tests/restricted.sh
++++ b/src/cmd/ksh93/tests/restricted.sh
+@@ -87,4 +87,10 @@ for i in PATH ENV FPATH
+ do	check_restricted  "function foo { typeset $i=foobar;};foo" || err_exit "$i can be changed in function by using typeset"
+ done
+ 
++# ======
++# `set +r` and `set +o restricted` should not unset the restricted option
++check_restricted 'set +r' 2> /dev/null || err_exit '`set +r` unsets the restricted option'
++check_restricted 'set +o restricted' 2> /dev/null || err_exit '`set +o restricted` unsets the restricted option'
++
++# ======
+ exit $((Errors<125?Errors:125))

SOURCES/ksh-20120801-subshell-interrupt-segv.patch

@@ -0,0 +1,121 @@
+From 70f6d758c0f2fda90bc3d49331397ffd62dca3af Mon Sep 17 00:00:00 2001
+From: Martijn Dekker <martijn@inlv.org>
+Date: Thu, 30 Jul 2020 01:22:11 +0100
+Subject: [PATCH] Fix blocked signals after fork(2)ing external command in
+ subshell
+
+When the classic fork/exec mechanism was used (via sh_fork()) to
+run an external command from within a non-forking subshell, SIGINT
+was blocked until that subshell was exited. If a subsequent loop
+was run in the subshell, it became uninterruptible, e.g.:
+
+   $ arch/*/bin/ksh -c '(/usr/bin/true; while :; do :; done); exit'
+   ^C^C^C^C^C
+
+src/cmd/ksh93/sh/xec.c:
+- sh_fork() did not reset the savesig variable in the parent part
+  of the fork when running in a virtual subshell. This had the
+  effect of delaying signal handling until exiting the subshell.
+  There is no reason for that subshell check that I can discern, so
+  this removes it.
+      I've verified that this causes no regression test failures
+  even when ksh is compiled with -DSHOPT_SPAWN=0 which means the
+  classic fork/exec mechanism is always used.
+
+Fixes: https://github.com/ksh93/ksh/issues/86
+
+Cherry-picked-by: Lukáš Zaoral <lzaoral@redhat.com>
+Upstream-commit: 70f6d758c0f2fda90bc3d49331397ffd62dca3af
+---
+ src/cmd/ksh93/sh/xec.c          | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/src/cmd/ksh93/sh/xec.c b/src/cmd/ksh93/sh/xec.c
+index a6ad50747548..baa8d6d1287a 100644
+--- a/src/cmd/ksh93/sh/xec.c
++++ b/src/cmd/ksh93/sh/xec.c
+@@ -2951,13 +2951,10 @@ pid_t sh_fork(Shell_t *shp,int flags, int *jobid)
+ 	shp->savesig = -1;
+ 	while(_sh_fork(shp,parent=fork(),flags,jobid) < 0);
+ 	sh_stats(STAT_FORKS);
+-	if(!shp->subshell)
+-	{
+-		sig = shp->savesig;
+-		shp->savesig = 0;
+-		if(sig>0)
+-			kill(getpid(),sig);
+-	}
++	sig = shp->savesig;
++	shp->savesig = 0;
++	if(sig>0)
++		kill(getpid(),sig);
+ 	job_fork(parent);
+ 	return(parent);
+ }
+
+
+From 91a7c2e3e9feb8ac1391146ebcda9e6adfcd3cfb Mon Sep 17 00:00:00 2001
+From: Martijn Dekker <martijn@inlv.org>
+Date: Mon, 27 Dec 2021 03:00:15 +0000
+Subject: [PATCH] Fix crash/freeze upon interrupting command substitution with
+ pipe
+
+On some systems (at least Linux and macOS):
+
+1. Run on a command line: t=$(sleep 10|while :; do :; done)
+2. Press Ctrl+C in the first 10 seconds.
+3. Execute any other command substitution. The shell crashes.
+
+Analysis: Something in the job_wait() call in the sh_subshell()
+restore routine may be interrupted by a signal such as SIGINT on
+Linux and macOS. Exactly what that interruptible thing is remains
+to be determined. In any case, since job_wait() was invoked after
+sh_popcontext(), interrupting it caused the sh_subshell() restore
+routine to be aborted, resulting in an inconsistent state of the
+shell. The fix is to sh_popcontext() at a later stage instead.
+
+src/cmd/ksh93/sh/subshell.c: sh_subshell():
+- Move the sh_popcontext() call to near the end, just after
+  decreasing the subshell level counters and restoring the global
+  subshell data struct to its parent. This seems like a logical
+  place for it and could allow other things to be interrupted, too.
+- Get rid of the if(shp->subshell) because it is known that the
+  value is > 0 at this point.
+- The short exit routine run if the subshell forked now needs a new
+  sh_popcontext() call, because this is handled before restoring
+  the virtual subshell state.
+
+Fixes: https://github.com/ksh93/ksh/issues/397
+
+Cherry-picked-by: Lukáš Zaoral <lzaoral@redhat.com>
+Upstream-commit: 91a7c2e3e9feb8ac1391146ebcda9e6adfcd3cfb
+---
+ src/cmd/ksh93/sh/subshell.c     | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/src/cmd/ksh93/sh/subshell.c b/src/cmd/ksh93/sh/subshell.c
+@@ -681,10 +681,10 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_t *t, volatile int flags, int comsub)
+ 		sh_trap(trap,0);
+ 		free(trap);
+ 	}
+-	sh_popcontext(shp,&buff);
+ 	if(shp->subshell==0)	/* must be child process */
+ 	{
+ 		subshell_data = sp->prev;
++		sh_popcontext(shp,&buff);
+ 		if(jmpval==SH_JMPSCRIPT)
+ 			siglongjmp(*shp->jmplist,jmpval);
+ 		shp->exitval &= SH_EXITMASK;
+@@ -886,10 +886,10 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_t *t, volatile int flags, int comsub)
+ #if SHOPT_COSHELL
+ 	shp->coshell = sp->coshell;
+ #endif /* SHOPT_COSHELL */
+-	if(shp->subshell)
+-		SH_SUBSHELLNOD->nvalue.s = --shp->subshell;
++	SH_SUBSHELLNOD->nvalue.s = --shp->subshell;
+	subshell = shp->subshell;
+ 	subshell_data = sp->prev;
++	sh_popcontext(shp,&buff);
+ 	if(!argsav  ||  argsav->dolrefcnt==argcnt)
+ 		sh_argfree(shp,argsav,0);
+ 	if(shp->topfd != buff.topfd)

SOURCES/ksh-20120801-xtrace-utf8-quoting.patch

@@ -0,0 +1,141 @@
+From f9d28935bb93fe7336ba8c5eab4231050de2e11e Mon Sep 17 00:00:00 2001
+From: Martijn Dekker <martijn@inlv.org>
+Date: Fri, 10 Jul 2020 01:38:13 +0100
+Subject: [PATCH] Fix UTF-8 shellquoting for xtrace, printf %q, etc.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This fixes an annoying issue in the shell's quoting algorithm
+(used for xtrace (set -x), printf %q, and other things) for UTF-8
+locales, that caused it to encode perfectly printable UTF-8
+characters unnecessarily and inconsistently. For example:
+
+$ (set -x; : 'aeu aéu')
++ : $'aeu a\u[e9]u'
+$ (set -x; : 'aéu aeu')
++ : 'aéu aeu'
+$ (set -x; : '正常終了 aeu')
++ : '正常終了 aeu'
+$ (set -x; : 'aeu 正常終了')
++ : $'aeu \u[6b63]\u[5e38]\u[7d42]\u[4e86]'
+
+This issue was originally reported by lijo george in May 2017:
+https://www.mail-archive.com/ast-developers@lists.research.att.com/msg01958.html
+
+src/cmd/ksh93/sh/string.c:
+- Add is_invisible() function that returns true if a character is a
+  Unicode invisible (non-graph) character, excluding ASCII space.
+  Ref.: https://unicode.org/charts/PDF/U2000.pdf
+- Use a fallback in is_invisible() if we cannot use the system's
+  iswprint(3); this is the case for the ksh C.UTF-8 locale if the
+  OS doesn't support that. Fall back to a hardcoded blacklist of
+  invisible and control characters and put up with not encoding
+  nonexistent characters into \u[xxxx] escapes.
+  Ref.: https://unicode.org/charts/PDF/U2000.pdf
+- When deciding whether to switch to $'...' quoting mode (state=2),
+  use is_invisible() instead of testing for ASCII 0-127 range.
+- In $'...' quoting mode, use is_invisible() to decide whether to
+  encode wide characters into \u[xxxx] escapes.
+
+src/cmd/ksh93/tests/builtins.sh:
+- Add regression tests for shellquoting Arabic, Japanese and Latin
+  UTF-8 characters, to be run only in a UTF-8 locale. The Arabic
+  sample text[*] contains a couple of direction markers that are
+  expected to be encoded into \u[xxxx] escapes.
+
+[*] source: https://r12a.github.io/scripts/tutorial/summaries/arabic
+
+Upstream-commit: f9d28935bb93fe7336ba8c5eab4231050de2e11e
+Cherry-picked-by: Lukáš Zaoral <lzaoral@redhat.com>
+---
+ src/cmd/ksh93/sh/string.c       | 32 ++++++++++++++++++++++++++++++--
+ src/cmd/ksh93/tests/builtins.sh | 18 ++++++++++++++++++
+ 2 files changed, 48 insertions(+), 2 deletions(-)
+
+diff --git a/src/cmd/ksh93/sh/string.c b/src/cmd/ksh93/sh/string.c
+index 5eb124b75b23..fd620a09e9b0 100644
+--- a/src/cmd/ksh93/sh/string.c
++++ b/src/cmd/ksh93/sh/string.c
+@@ -325,6 +325,34 @@ static char	*sh_fmtcsv(const char *string)
+ 	return(stakptr(offset));
+ }
+ 
++#if SHOPT_MULTIBYTE
++/*
++ * Returns true if c is an invisible Unicode character, excluding ASCII space.
++ * Use iswgraph(3) if possible. In the ksh-specific C.UTF-8 locale, this is
++ * generally not possible as the OS-provided iswgraph(3) doesn't support that
++ * locale. So do a quick test and do our best with a fallback if necessary.
++ */
++static int	is_invisible(int c)
++{
++	if(!mbwide())					/* not in multibyte locale? */
++		return(c != ' ' && !isgraph(c));	/* use plain isgraph(3) */
++	else if(iswgraph(0x5E38) && !iswgraph(0xFEFF))	/* can we use iswgraph(3)? */
++		return(c != ' ' && !iswgraph(c));	/* use iswgraph(3) */
++	else						/* fallback: */
++		return(	c <= 0x001F ||			/* control characters */
++			c >= 0x007F && c <= 0x009F ||	/* control characters */
++			c == 0x00A0 ||			/* non-breaking space */
++			c == 0x061C ||			/* arabic letter mark */
++			c == 0x1680 ||			/* ogham space mark */
++			c == 0x180E ||			/* mongolian vowel separator */
++			c >= 0x2000 && c <= 0x200F ||	/* spaces and format characters */
++			c >= 0x2028 && c <= 0x202F ||	/* separators and format characters */
++			c >= 0x205F && c <= 0x206F ||	/* various format characters */
++			c == 0x3000 ||			/* ideographic space */
++			c == 0xFEFF );			/* zero-width non-breaking space */
++}
++#endif /* SHOPT_MULTIBYTE */
++
+ /*
+  * print <str> quoting chars so that it can be read by the shell
+  * puts null terminated result on stack, but doesn't freeze it
+@@ -363,7 +391,7 @@ char	*sh_fmtq(const char *string)
+ 	for(;c;c= mbchar(cp))
+ 	{
+ #if SHOPT_MULTIBYTE
+-		if(c=='\'' || c>=128 || c<0 || !iswprint(c)) 
++		if(c=='\'' || is_invisible(c))
+ #else
+ 		if(c=='\'' || !isprint(c))
+ #endif /* SHOPT_MULTIBYTE */
+@@ -426,7 +454,7 @@ char	*sh_fmtq(const char *string)
+ 					cp = op+1;
+ 					isbyte = 1;
+ 				}
+-				if(mbwide() && ((cp-op)>1))
++				if(mbwide() && is_invisible(c))
+ 				{
+ 					sfprintf(staksp,"\\u[%x]",c);
+ 					continue;
+diff --git a/src/cmd/ksh93/tests/builtins.sh b/src/cmd/ksh93/tests/builtins.sh
+index 66d465e0a205..34ef9c914f29 100755
+--- a/src/cmd/ksh93/tests/builtins.sh
++++ b/src/cmd/ksh93/tests/builtins.sh
+@@ -318,6 +318,24 @@
+ then	err_exit "printf '%..*s' not working"
+ fi
+ [[ $(printf '%q\n') == '' ]] || err_exit 'printf "%q" with missing arguments'
++# shell-quoting UTF-8 characters: check for unnecessary encoding
++case ${LC_ALL:-${LC_CTYPE:-${LANG:-}}} in
++( *[Uu][Tt][Ff]8* | *[Uu][Tt][Ff]-8* )
++	expect=$'$\'عندما يريد العالم أن \\u[202a]يتكلّم \\u[202c] ، فهو يتحدّث بلغة يونيكود.\''
++	actual=$(printf %q 'عندما يريد العالم أن ‪يتكلّم ‬ ، فهو يتحدّث بلغة يونيكود.')
++	[[ $actual == "$expect" ]] || err_exit 'shell-quoting: Arabic UTF-8 characters' \
++				"(expected $expect; got $actual)"
++	expect="'正常終了 正常終了'"
++	actual=$(printf %q '正常終了 正常終了')
++	[[ $actual == "$expect" ]] || err_exit 'shell-quoting: Japanese UTF-8 characters' \
++				"(expected $expect; got $actual)"
++	expect="'aeu aéu'"
++	actual=$(printf %q 'aeu aéu')
++	[[ $actual == "$expect" ]] || err_exit 'shell-quoting: Latin UTF-8 characters' \
++				"(expected $expect; got $actual)"
++	;;
++esac
++
+ # we won't get hit by the one second boundary twice, right?
+ [[ $(printf '%T\n' now | sed 's/GMT/UTC/') == "$(date)" ]] ||
+ [[ $(printf '%T\n' now | sed 's/GMT/UTC/') == "$(date)" ]] ||

SPECS/ksh.spec

@@ -6,7 +6,7 @@ Summary:      The Original ATT Korn Shell
 URL:          http://www.kornshell.com/
 License:      EPL-1.0
 Version:      %{releasedate}
-Release:      259%{?dist}
+Release:      267%{?dist}
 Source0:      http://www.research.att.com/~gsf/download/tgz/ast-ksh.%{release_date}.tgz
 Source1:      http://www.research.att.com/~gsf/download/tgz/INIT.%{release_date}.tgz
 Source2:      kshcomp.conf
@@ -105,9 +105,6 @@ Patch45: ksh-20140415-hokaido.patch
 # for ksh < 2012-10-04, rhbz#1121960
 Patch46: ksh-20120801-tpstl.patch
 
-# sent upstream, rhbz#1100215
-Patch47: ksh-20120801-manfix4.patch
-
 # not upstream yet, rhbz#1100215
 Patch48: ksh-20120801-fununset.patch
 
@@ -236,6 +233,30 @@ Patch93: ksh-20120801-stack-robustness-2.patch
 # upstream commit: https://github.com/ksh93/ksh/commit/6f3b23e6f4d59590a51bfbcc66dc60082728b71d
 Patch94: ksh-20120801-segfault-long-command.patch
 
+# rhbz#1948588
+# upstream commit: https://github.com/ksh93/ksh/commit/74b4162178c8a2347491b9fd3a22d8e6e1b7e831
+Patch95: ksh-20120801-set+r-fix.patch
+
+# RHEL-11982
+# upstream commit: https://github.com/ksh93/ksh/commit/9eb8532ccacf1cfdb7ba18f51eba68776852ef7c.patch
+Patch96: ksh-20120801-segfault-strdup.patch
+
+# RHEL-12011
+# upstream commit: https://github.com/ksh93/ksh/commit/035a4cb3f453271b7ae63bcb53a7963b8dbe4c41
+Patch97: ksh-20120801-segfault-cd-paths.patch
+
+# RHEL-5684
+# upstream commit: https://github.com/ksh93/ksh/commit/f9d28935bb93fe7336ba8c5eab4231050de2e11e
+Patch98: ksh-20120801-xtrace-utf8-quoting.patch
+
+# RHEL-5685
+# upstream commit: https://github.com/ksh93/ksh/commit/2075b2b96208ac8b989ca316dcdd674c3f488e2b
+Patch99: %{name}-1.0.7-history-trim.patch
+
+# RHEL-11650
+# upstream commit: https://github.com/ksh93/ksh/commit/70f6d758c0f2fda90bc3d49331397ffd62dca3af
+# upstream commit: https://github.com/ksh93/ksh/commit/91a7c2e3e9feb8ac1391146ebcda9e6adfcd3cfb
+Patch100: ksh-20120801-subshell-interrupt-segv.patch
 
 Conflicts:    pdksh
 Requires: coreutils, diffutils, chkconfig
@@ -390,6 +411,35 @@ fi
 %config(noreplace) %{_sysconfdir}/binfmt.d/kshcomp.conf
 
 %changelog
+* Fri Feb 09 2024 Vincent Mihalkovic <vmihalko@redhat.com> - 20120801-267
+- Re-fix segfault in strdup
+  Resolves: RHEL-11982
+
+* Thu Jan 25 2024 Lukáš Zaoral <lzaoral@redhat.com> - 20120801-266
+- fix crashes when interrupting subshells (RHEL-11650)
+
+* Wed Jan 03 2024 Vincent Mihalkovic <vmihalko@redhat.com> - 20120801-265
+- Fix crash on failure to trim ~/.sh_history (RHEL-5685)
+
+* Wed Nov 22 2023 Vincent Mihalkovic <vmihalko@redhat.com> - 20120801-264
+- Remove broken monitor patch
+
+* Thu Nov 09 2023 Lukáš Zaoral <lzaoral@redhat.com> - 20120801-263
+- fix UTF-8 quoting in xtrace
+  Resolves: RHEL-5684
+
+* Wed Nov 08 2023 Lukáš Zaoral <lzaoral@redhat.com> - 20120801-262
+- fix segfault in subshell if $PATH contains a .paths directory
+  Resolves: RHEL-12011
+
+* Tue Oct 31 2023 Lukáš Zaoral <lzaoral@redhat.com> - 20120801-261
+- Fix segfault in strdup
+  Resolves: RHEL-11982
+
+* Mon Sep 18 2023 Lukáš Zaoral <lzaoral@redhat.com> - 20120801-260
+- Fix set +r so that it cannot unset the restricted option
+  Resolves: #1948588
+
 * Fri Aug 25 2023 Vincent Mihalkovic <vmihalko@redhat.com> - 20120801-259
 - Fix crash on trying a very long command
   Fix license tag