If do-lowercase-version is bound to a key that is either not an uppercase
character or is a character that is its own lowercase version, then
readline will either loop forever with no way to interrupt (if the compiler
optimized out the recursion) or will exceed the stack depth and segfault.

$ bind '".": do-lowercase-version'
$ .

----
diff --git a/lib/readline/readline.c b/lib/readline/readline.c
index 65eb54e9..19d73aba 100644
--- a/lib/readline/readline.c
+++ b/lib/readline/readline.c
@@ -906,7 +906,13 @@ _rl_dispatch_subseq (register int key, Keymap map, int
got_subseq)
          /* Special case rl_do_lowercase_version (). */
          if (func == rl_do_lowercase_version)
            /* Should we do anything special if key == ANYOTHERKEY? */
-           return (_rl_dispatch (_rl_to_lower ((unsigned char)key), map));
+            if ((newkey = _rl_to_lower ((unsigned char)key)) != key)
+              return (_rl_dispatch (newkey, map));
+            else
+              {
+                rl_ding ();
+                return 0;
+              }

          rl_executing_keymap = map;
          rl_executing_key = key;

Reply via email to