From 23f2e23385aca41ba03427f241434096195d4e54 Mon Sep 17 00:00:00 2001
From: Johnothan King <johnothanking@protonmail.com>
Date: Wed, 5 Aug 2020 10:06:16 -0700
Subject: [PATCH] Over-shifting in a POSIX function should cause scripts to
 exit (#106)

The required longjmp used to terminate scripts was not being run
when over-shifting in a POSIX function with a redirection. This
caused scripts to continue after an error in the shift builtin,
which is incorrect since shift is a special builtin. The
interpreter is sent into an indeterminate state that causes
undefined behavior as well:
$ cat reproducer.ksh
some_func() {
   shift 10
}

for i in a b c d e f; do
  echo "read $i"
  [ "$i" != "c" ] && continue
  some_func 2>&1
  echo "$i = c"
done
$ ksh ./reproducer.ksh
read a
read b
read c
/tmp/k[2]: shift: 10: bad number
c = c
read d
/tmp/k[2]: shift: 10: bad number
d = c
read e
/tmp/k[2]: shift: 10: bad number
e = c
read f
/tmp/k[2]: shift: 10: bad number
f = c

src/cmd/ksh93/sh/xec.c: sh_exec():
- Do the necessary longjmp needed to terminate the script after
  over-shifting in a POSIX function when the function call has a
  redirection.

src/cmd/ksh93/tests/functions.sh:
- Add the over-shifting regression test from ksh93v- 2013-10-10-alpha.

Bug report and fix on the old mailing list:
https://www.mail-archive.com/ast-developers@lists.research.att.com/msg00732.html
---
 NEWS                             |  5 +++++
 src/cmd/ksh93/include/version.h  |  2 +-
 src/cmd/ksh93/sh/xec.c           |  2 +-
 src/cmd/ksh93/tests/functions.sh | 14 ++++++++++++++
 4 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/NEWS b/NEWS
index af16cf6b9..6b9e2101a 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,11 @@ For full details, see the git log at: https://github.com/ksh93/ksh
 
 Any uppercase BUG_* names are modernish shell bug IDs.
 
+2020-08-05:
+
+- Fixed a bug that caused scripts to continue running after over-shifting
+  in a function when the function call had a redirection.
+
 2020-07-31:
 
 - Fixed a bug that caused multidimensional associative arrays to be created
diff --git a/src/cmd/ksh93/include/version.h b/src/cmd/ksh93/include/version.h
index 740def0ed..944606454 100644
--- a/src/cmd/ksh93/include/version.h
+++ b/src/cmd/ksh93/include/version.h
@@ -17,4 +17,4 @@
 *                  David Korn <dgk@research.att.com>                   *
 *                                                                      *
 ***********************************************************************/
-#define SH_RELEASE	"93u+m 2020-07-31"
+#define SH_RELEASE	"93u+m 2020-08-05"
diff --git a/src/cmd/ksh93/sh/xec.c b/src/cmd/ksh93/sh/xec.c
index baa8d6d12..0bc710a7d 100644
--- a/src/cmd/ksh93/sh/xec.c
+++ b/src/cmd/ksh93/sh/xec.c
@@ -1508,7 +1508,7 @@ int sh_exec(register const Shnode_t *t, int flags)
 						unset_instance(nq,&node,&nr,mode);
 					sh_funstaks(slp->slchild,-1);
 					stakdelete(slp->slptr);
-					if(jmpval > SH_JMPFUN)
+					if(jmpval > SH_JMPFUN || (io && jmpval > SH_JMPIO))
 						siglongjmp(*shp->jmplist,jmpval);
 					goto setexit;
 				}
diff --git a/src/cmd/ksh93/tests/functions.sh b/src/cmd/ksh93/tests/functions.sh
index 7178bbf97..7374b29c6 100755
--- a/src/cmd/ksh93/tests/functions.sh
+++ b/src/cmd/ksh93/tests/functions.sh
@@ -1261,5 +1261,19 @@ function f2 { env | grep -q "^foo" || err_exit "Environment variable is not prop
 function f1 { f2; env | grep -q "^foo" || err_exit "Environment variable is not passed to a function"; }
 foo=bar f1
 
+# ======
+# Over-shifting in a POSIX function should terminate the script
+$SHELL <<- \EOF
+	fun() {
+		shift 10
+	}
+	for i in a b
+	do
+		fun 2> /dev/null
+		[[ $i == b ]] && exit 2
+	done
+EOF
+[[ $? == 2 ]] && err_exit 'Over-shifting in a POSIX function does not terminate the script if the function call has a redirection'
+
 # ======
 exit $((Errors<125?Errors:125))