From 8e774b6c184bdff850f6889865a0d4f0522638a4 Mon Sep 17 00:00:00 2001
From: "Todd C. Miller" <millert@cvs.openbsd.org>
Date: Wed, 24 Aug 2016 13:32:18 +0000
Subject: Avoid recursively calling c_fc().  Fixes a core dump from "r r" and
 other edge cases found by gsoares@.  OK tb@ gsoares@

---
 bin/ksh/history.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

(limited to 'bin/ksh')

diff --git a/bin/ksh/history.c b/bin/ksh/history.c
index 78f9fb7468e..be9874f0107 100644
--- a/bin/ksh/history.c
+++ b/bin/ksh/history.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: history.c,v 1.56 2015/12/30 09:07:00 tedu Exp $	*/
+/*	$OpenBSD: history.c,v 1.57 2016/08/24 13:32:17 millert Exp $	*/
 
 /*
  * command history
@@ -60,9 +60,15 @@ c_fc(char **wp)
 	struct temp *tf = NULL;
 	char *p, *editor = NULL;
 	int gflag = 0, lflag = 0, nflag = 0, sflag = 0, rflag = 0;
-	int optc;
+	int optc, ret;
 	char *first = NULL, *last = NULL;
 	char **hfirst, **hlast, **hp;
+	static int depth;
+
+	if (depth != 0) {
+		bi_errorf("history function called recursively");
+		return 1;
+	}
 
 	if (!Flag(FTALKING_I)) {
 		bi_errorf("history functions not available");
@@ -145,7 +151,10 @@ c_fc(char **wp)
 		    hist_get_newest(false);
 		if (!hp)
 			return 1;
-		return hist_replace(hp, pat, rep, gflag);
+		depth++;
+		ret = hist_replace(hp, pat, rep, gflag);
+		depth--;
+		return ret;
 	}
 
 	if (editor && (lflag || nflag)) {
@@ -229,7 +238,6 @@ c_fc(char **wp)
 	/* XXX: source should not get trashed by this.. */
 	{
 		Source *sold = source;
-		int ret;
 
 		ret = command(editor ? editor : "${FCEDIT:-/bin/ed} $_", 0);
 		source = sold;
@@ -265,7 +273,10 @@ c_fc(char **wp)
 		shf_close(shf);
 		*xp = '\0';
 		strip_nuls(Xstring(xs, xp), Xlength(xs, xp));
-		return hist_execute(Xstring(xs, xp));
+		depth++;
+		ret = hist_execute(Xstring(xs, xp));
+		depth--;
+		return ret;
 	}
 }
 
-- 
cgit v1.2.3