tcsh-6.20.00-003-fix-out-of-bounds-read.patch added

To fix crashing when pressing TAB for auto-completion, etc.

  This might be possible security issue, fixing this pre-emptively.

tcsh-6.20.00-003-fix-out-of-bounds-read.patch

@@ -0,0 +1,26 @@
+From 6a542dc4fb2ba26518a47e9b3a9bcd6a91b94596 Mon Sep 17 00:00:00 2001
+From: christos <christos>
+Date: Fri, 2 Dec 2016 16:59:28 +0000
+Subject: [PATCH] Fix out of bounds read (Brooks Davis) (reproduce by starting
+ tcsh and hitting tab at the prompt)
+
+---
+ ed.chared.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ed.chared.c b/ed.chared.c
+index 1277e53..310393e 100644
+--- a/ed.chared.c
++++ b/ed.chared.c
+@@ -750,7 +750,7 @@ c_substitute(void)
+     /*
+      * If we found a history character, go expand it.
+      */
+-    if (HIST != '\0' && *p == HIST)
++    if (p >= InputBuf && HIST != '\0' && *p == HIST)
+ 	nr_exp = c_excl(p);
+     else
+         nr_exp = 0;
+-- 
+2.7.4
+

tcsh.spec

@@ -1,7 +1,7 @@
 Name:             tcsh
 Summary:          An enhanced version of csh, the C shell
 Version:          6.20.00
-Release:          2%{?dist}
+Release:          3%{?dist}
 License:          BSD
 
 URL:              http://www.tcsh.org/
@@ -44,6 +44,7 @@ BuildRequires:    ncurses-devel
 Patch000: tcsh-6.20.00-000-add-all-flags-for-gethost-build.patch
 Patch001: tcsh-6.20.00-001-delay-arginp-interpreting.patch
 Patch002: tcsh-6.20.00-002-type-of-read-in-prompt-confirm.patch
+Patch003: tcsh-6.20.00-003-fix-out-of-bounds-read.patch
 
 
 # Downstream patches -- these should be always included when doing rebase:
@@ -170,6 +171,9 @@ fi
 
 
 %changelog
+* Mon Dec  5 2016 David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 6.20.00-3
+- Added tcsh-6.20.00-003-fix-out-of-bounds-read.patch
+
 * Mon Nov 28 2016 David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 6.20.00-2
 - Added multiple upstream patches:
     tcsh-6.20.00-000-add-all-flags-for-gethost-build.patch