Apply fixes from upstream to prevent a crash and a usability issue:

- Fix type of read in prompt confirmation (eg. rmstar) (David Kaspar)
- Fix out of bounds read (Brooks Davis)
- Don't play pointer tricks that are undefined in modern c (Brooks Davis)
- Use `` instead $() for solaris, bleh.

6 files changed, 109 insertions, 3 deletions

diff --git a/shells/tcsh/Makefile b/shells/tcsh/Makefile
index 4f2807e2afc..0046286d203 100644
--- a/shells/tcsh/Makefile
+++ b/shells/tcsh/Makefile
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.82 2016/11/24 15:45:06 christos Exp $
+# $NetBSD: Makefile,v 1.83 2016/12/24 13:18:43 kim Exp $
 
 DISTNAME=	tcsh-6.20.00
-#PKGREVISION=	1
+PKGREVISION=	1
 CATEGORIES=	shells
 MASTER_SITES=	ftp://ftp.astron.com/pub/tcsh/ \
 		ftp://ftp.funet.fi/pub/mirrors/ftp.astron.com/pub/tcsh/
diff --git a/shells/tcsh/distinfo b/shells/tcsh/distinfo
index 0f20265244b..49ee5f29324 100644
--- a/shells/tcsh/distinfo
+++ b/shells/tcsh/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.37 2016/11/24 15:45:06 christos Exp $
+$NetBSD: distinfo,v 1.38 2016/12/24 13:18:43 kim Exp $
 
 SHA1 (tcsh-6.20.00.tar.gz) = a77d68434cc4bed731a46a39b9e01523e3a1e98c
 RMD160 (tcsh-6.20.00.tar.gz) = 3f119421ef3500cea1bebe2edf35c6d81ca1c8f3
@@ -7,4 +7,8 @@ Size (tcsh-6.20.00.tar.gz) = 1001696 bytes
 SHA1 (patch-aa) = 440849534fc49afdbd70b95d6cbc62ff5abee240
 SHA1 (patch-ab) = 8cf26988778b5331360eb1aab98bfcc920c71ac2
 SHA1 (patch-configure) = 91c2019da8c074bd6f24b84bf798ccd497110727
+SHA1 (patch-ed.chared.c) = d26ba00afcba958b5bb1efc2171e6211c8a5f964
+SHA1 (patch-nls-catgen) = fe5da1ea0edfcb646bcc271e614f5075afa56c60
+SHA1 (patch-sh.func.c) = 030a2647930300f96147715ae17ab95c79ca8ca2
 SHA1 (patch-sh.h) = ac6211ddd5e552e9baec2d35aed5e7e573cab04e
+SHA1 (patch-tw.init.c) = 4ed0f6632e149d8badcb8338817af5f9095e34b4
diff --git a/shells/tcsh/patches/patch-ed.chared.c b/shells/tcsh/patches/patch-ed.chared.c
new file mode 100644
index 00000000000..965eda5e010
--- /dev/null
+++ b/shells/tcsh/patches/patch-ed.chared.c
@@ -0,0 +1,22 @@
+$NetBSD: patch-ed.chared.c,v 1.1 2016/12/24 13:18:43 kim Exp $
+
+Fix out of bounds read (Brooks Davis)
+(reproduce by starting tcsh and hitting tab at the prompt)
+
+Index: ed.chared.c
+===================================================================
+RCS file: /p/tcsh/cvsroot/tcsh/ed.chared.c,v
+retrieving revision 3.103
+retrieving revision 3.104
+diff -u -r3.103 -r3.104
+--- ed.chared.c	19 Aug 2015 14:29:55 -0000	3.103
++++ ed.chared.c	2 Dec 2016 16:59:28 -0000	3.104
+@@ -750,7 +750,7 @@
+     /*
+      * If we found a history character, go expand it.
+      */
+-    if (HIST != '\0' && *p == HIST)
++    if (p >= InputBuf && HIST != '\0' && *p == HIST)
+ 	nr_exp = c_excl(p);
+     else
+         nr_exp = 0;
diff --git a/shells/tcsh/patches/patch-nls-catgen b/shells/tcsh/patches/patch-nls-catgen
new file mode 100644
index 00000000000..261b98a772e
--- /dev/null
+++ b/shells/tcsh/patches/patch-nls-catgen
@@ -0,0 +1,23 @@
+$NetBSD: patch-nls-catgen,v 1.1 2016/12/24 13:18:43 kim Exp $
+
+use `` instead $() for solaris, bleh.
+
+Index: nls/catgen
+===================================================================
+RCS file: /p/tcsh/cvsroot/tcsh/nls/catgen,v
+retrieving revision 1.4
+retrieving revision 1.5
+diff -u -r1.4 -r1.5
+--- nls/catgen	25 Jul 2014 14:45:25 -0000	1.4
++++ nls/catgen	26 Nov 2016 00:35:37 -0000	1.5
+@@ -13,8 +13,8 @@
+ shift
+ CHARSET="$1"
+ shift
+-cat "${CHARSET}" $(sortit "$@") > "$TMP"
++cat "${CHARSET}" `sortit "$@"` > "$TMP"
+ 
+-echo "$(basename "$OUT" .cat)"
++echo "`basename "$OUT" .cat`"
+ "${GENCAT}" "$OUT" "$TMP"
+ exit 0
diff --git a/shells/tcsh/patches/patch-sh.func.c b/shells/tcsh/patches/patch-sh.func.c
new file mode 100644
index 00000000000..26f0b8524de
--- /dev/null
+++ b/shells/tcsh/patches/patch-sh.func.c
@@ -0,0 +1,34 @@
+$NetBSD: patch-sh.func.c,v 1.1 2016/12/24 13:18:43 kim Exp $
+
+Fix type of read in prompt confirmation (eg. rmstar) (David Kaspar)
+
+Index: sh.func.c
+===================================================================
+RCS file: /p/tcsh/cvsroot/tcsh/sh.func.c,v
+retrieving revision 3.176
+retrieving revision 3.177
+diff -u -r3.176 -r3.177
+--- sh.func.c	18 Oct 2016 17:26:42 -0000	3.176
++++ sh.func.c	28 Nov 2016 17:14:20 -0000	3.177
+@@ -2734,16 +2734,18 @@
+ int
+ getYN(const char *prompt)
+ {
+-    int doit, c;
++    int doit;
++    char c;
++
+     xprintf("%s", prompt);
+     flush();
+-    (void) force_read(SHIN, &c, 1);
++    (void) force_read(SHIN, &c, sizeof(c));
+     /* 
+      * Perhaps we should use the yesexpr from the
+      * actual locale
+      */
+     doit = (strchr(CGETS(22, 14, "Yy"), c) != NULL);
+-    while (c != '\n' && force_read(SHIN, &c, 1) == 1)
++    while (c != '\n' && force_read(SHIN, &c, sizeof(c)) == sizeof(c))
+ 	continue;
+     return doit;
+ }
diff --git a/shells/tcsh/patches/patch-tw.init.c b/shells/tcsh/patches/patch-tw.init.c
new file mode 100644
index 00000000000..17995859af8
--- /dev/null
+++ b/shells/tcsh/patches/patch-tw.init.c
@@ -0,0 +1,23 @@
+$NetBSD: patch-tw.init.c,v 1.1 2016/12/24 13:18:43 kim Exp $
+
+Don't play pointer tricks that are undefined in modern c (Brooks Davis)
+
+Index: tw.init.c
+===================================================================
+RCS file: /p/tcsh/cvsroot/tcsh/tw.init.c,v
+retrieving revision 3.42
+retrieving revision 3.43
+diff -u -r3.42 -r3.43
+--- tw.init.c	17 Apr 2011 14:49:30 -0000	3.42
++++ tw.init.c	7 Dec 2016 02:52:27 -0000	3.43
+@@ -125,9 +125,8 @@
+ 	sl->buff = xrealloc(sl->buff, sl->tbuff * sizeof(Char));
+ 	/* Re-thread the new pointer list, if changed */
+ 	if (ptr != NULL && ptr != sl->buff) {
+-	    intptr_t offs = sl->buff - ptr;
+ 	    for (i = 0; i < sl->nlist; i++)
+-		sl->list[i] += offs;
++		sl->list[i] = sl->buff + (sl->list[i] - ptr);
+ 	}
+ 	disabled_cleanup(&pintr_disabled);
+     }