READLINE PATCH REPORT ===================== Readline-Release: 8.3 Patch-ID: readline83-003 Bug-Reported-by: penguin p Bug-Reference-ID: Bug-Reference-URL: https://lists.gnu.org/archive/html/bug-bash/2025-08/msg00080.html Bug-Description: A SIGINT during a reverse i-search can cause a segmentation fault due to accessing data freed by a signal handler. Patch (apply with `patch -p0'): *** ../readline-8.3-patched/input.c Tue Jul 8 15:37:13 2025 --- input.c Fri Aug 22 15:04:05 2025 *************** *** 976,984 **** if (rl_signal_event_hook) (*rl_signal_event_hook) (); ! #if defined (READLINE_CALLBACKS) ! else if (osig == SIGINT && (ostate & RL_STATE_CALLBACK) && (ostate & (RL_STATE_ISEARCH|RL_STATE_NSEARCH|RL_STATE_NUMERICARG))) /* just these cases for now */ _rl_abort_internal (); - #endif } } --- 1004,1012 ---- if (rl_signal_event_hook) (*rl_signal_event_hook) (); ! /* If the application's SIGINT handler returns, make sure we abort out of ! searches and numeric arguments because we've freed necessary state. */ ! if (osig == SIGINT && (ostate & (RL_STATE_ISEARCH|RL_STATE_NSEARCH|RL_STATE_NUMERICARG))) /* just these cases for now */ _rl_abort_internal (); } } *** ../readline-8.3-patched/isearch.c Thu Jun 5 09:22:11 2025 --- isearch.c Tue Aug 19 14:55:55 2025 *************** *** 890,899 **** _rl_isearch_cleanup (_rl_search_cxt *cxt, int r) { if (r >= 0) _rl_isearch_fini (cxt); _rl_scxt_dispose (cxt, 0); - _rl_iscxt = 0; - - RL_UNSETSTATE(RL_STATE_ISEARCH); return (r != 0); --- 890,901 ---- _rl_isearch_cleanup (_rl_search_cxt *cxt, int r) { + RL_UNSETSTATE(RL_STATE_ISEARCH); + if (cxt == 0) + return (r != 0); + + _rl_iscxt = 0; if (r >= 0) _rl_isearch_fini (cxt); _rl_scxt_dispose (cxt, 0); return (r != 0); *** ../readline-8.3/patchlevel 2013-11-15 08:11:11.000000000 -0500 --- patchlevel 2024-03-21 08:28:40.000000000 -0400 *************** *** 1,3 **** # Do not edit -- exists only for use by patch ! 2 --- 1,3 ---- # Do not edit -- exists only for use by patch ! 3