BASH PATCH REPORT
			     =================

Bash-Release: 3.0
Patch-ID: bash30-018

Bug-Reported-by:	Tavis Ormandy <taviso@cmpxchg8b.com>
Bug-Reference-ID:
Bug-Reference-URL:	http://twitter.com/taviso/statuses/514887394294652929

Bug-Description:

Under certain circumstances, bash can incorrectly save a lookahead character and
return it on a subsequent call, even when reading a new line.

Patch:

*** ../bash-3.0.17/parse.y	2004-05-04 15:09:06.000000000 -0400
--- parse.y	2014-09-25 16:42:51.000000000 -0400
***************
*** 2484,2487 ****
--- 2484,2489 ----
    word_desc_to_read = (WORD_DESC *)NULL;
  
+   eol_ungetc_lookahead = 0;
+ 
    last_read_token = '\n';
    token_to_read = '\n';
*** ../bash-3.0.17/y.tab.c	2004-05-05 14:32:28.000000000 -0400
--- y.tab.c	2014-09-25 20:30:33.000000000 -0400
***************
*** 3814,3817 ****
--- 3814,3819 ----
    word_desc_to_read = (WORD_DESC *)NULL;
  
+   eol_ungetc_lookahead = 0;
+ 
    last_read_token = '\n';
    token_to_read = '\n';

*** ../bash-3.0/patchlevel.h	Wed Aug 22 08:05:39 2001
--- patchlevel.h	Thu Sep  2 15:04:32 2004
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 17
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 18
  
  #endif /* _PATCHLEVEL_H_ */