Submitted By:            Matt Burgess <matthew_at_linuxfromscratch_dot_org>
Date:                    2012-03-13
Initial Package Version: 4.2
Upstream Status:         Already in upstream patch repo
Origin:                  Upstream
Description:             This patch contains upstream patch numbers 001 thru 024.

diff -Naur bash-4.2.orig/assoc.c bash-4.2/assoc.c
--- bash-4.2.orig/assoc.c	2009-08-06 00:19:40.000000000 +0000
+++ bash-4.2/assoc.c	2012-03-13 21:53:47.610008764 +0000
@@ -77,6 +77,11 @@
   b = hash_search (key, hash, HASH_CREATE);
   if (b == 0)
     return -1;
+  /* If we are overwriting an existing element's value, we're not going to
+     use the key.  Nothing in the array assignment code path frees the key
+     string, so we can free it here to avoid a memory leak. */
+  if (b->key != key)
+    free (key);
   FREE (b->data);
   b->data = value ? savestring (value) : (char *)0;
   return (0);
diff -Naur bash-4.2.orig/builtins/declare.def bash-4.2/builtins/declare.def
--- bash-4.2.orig/builtins/declare.def	2010-05-30 22:25:21.000000000 +0000
+++ bash-4.2/builtins/declare.def	2012-03-13 21:53:47.632008803 +0000
@@ -513,6 +513,11 @@
 	      *subscript_start = '[';	/* ] */
 	      var = assign_array_element (name, value, 0);	/* XXX - not aflags */
 	      *subscript_start = '\0';
+	      if (var == 0)	/* some kind of assignment error */
+		{
+		  assign_error++;
+		  NEXT_VARIABLE ();
+		}
 	    }
 	  else if (simple_array_assign)
 	    {
diff -Naur bash-4.2.orig/builtins/fc.def bash-4.2/builtins/fc.def
--- bash-4.2.orig/builtins/fc.def	2010-05-30 22:25:38.000000000 +0000
+++ bash-4.2/builtins/fc.def	2012-03-13 21:53:47.605008754 +0000
@@ -304,7 +304,7 @@
   last_hist = i - rh - hist_last_line_added;
 
   /* XXX */
-  if (saved_command_line_count > 0 && i == last_hist && hlist[last_hist] == 0)
+  if (i == last_hist && hlist[last_hist] == 0)
     while (last_hist >= 0 && hlist[last_hist] == 0)
       last_hist--;
   if (last_hist < 0)
@@ -475,7 +475,7 @@
      HIST_ENTRY **hlist;
 {
   int sign, n, clen, rh;
-  register int i, j;
+  register int i, j, last_hist;
   register char *s;
 
   sign = 1;
@@ -495,7 +495,15 @@
      has been enabled (interactive or not) should use it in the last_hist
      calculation as if it were on. */
   rh = remember_on_history || ((subshell_environment & SUBSHELL_COMSUB) && enable_history_list);
-  i -= rh + hist_last_line_added;
+  last_hist = i - rh - hist_last_line_added;
+
+  if (i == last_hist && hlist[last_hist] == 0)
+    while (last_hist >= 0 && hlist[last_hist] == 0)
+      last_hist--;
+  if (last_hist < 0)
+    return (-1);
+
+  i = last_hist;
 
   /* No specification defaults to most recent command. */
   if (command == NULL)
diff -Naur bash-4.2.orig/builtins/printf.def bash-4.2/builtins/printf.def
--- bash-4.2.orig/builtins/printf.def	2010-11-23 15:02:55.000000000 +0000
+++ bash-4.2/builtins/printf.def	2012-03-13 21:53:47.643008823 +0000
@@ -255,6 +255,8 @@
 #endif
 	    {
 	      vflag = 1;
+	      if (vbsize == 0)
+		vbuf = xmalloc (vbsize = 16);
 	      vblen = 0;
 	      if (vbuf)
 		vbuf[0] = 0;
@@ -465,6 +467,9 @@
 		  secs = shell_start_time;	/* roughly $SECONDS */
 		else
 		  secs = arg;
+#if defined (HAVE_TZSET)
+		sv_tz ("TZ");		/* XXX -- just make sure */
+#endif
 		tm = localtime (&secs);
 		n = strftime (timebuf, sizeof (timebuf), timefmt, tm);
 		free (timefmt);
diff -Naur bash-4.2.orig/builtins/read.def bash-4.2/builtins/read.def
--- bash-4.2.orig/builtins/read.def	2011-01-04 16:43:36.000000000 +0000
+++ bash-4.2/builtins/read.def	2012-03-13 21:53:47.636008809 +0000
@@ -642,6 +642,12 @@
 	  xfree (input_string);
 	  return EXECUTION_FAILURE;	/* readonly or noassign */
 	}
+      if (assoc_p (var))
+	{
+          builtin_error (_("%s: cannot convert associative to indexed array"), arrayname);
+	  xfree (input_string);
+	  return EXECUTION_FAILURE;	/* existing associative array */
+	}
       array_flush (array_cell (var));
 
       alist = list_string (input_string, ifs_chars, 0);
@@ -731,7 +737,7 @@
 	      xfree (t1);
 	    }
 	  else
-	    var = bind_read_variable (varname, t);
+	    var = bind_read_variable (varname, t ? t : "");
 	}
       else
 	{
@@ -792,7 +798,7 @@
       xfree (t);
     }
   else
-    var = bind_read_variable (list->word->word, input_string);
+    var = bind_read_variable (list->word->word, input_string ? input_string : "");
 
   if (var)
     {
diff -Naur bash-4.2.orig/error.c bash-4.2/error.c
--- bash-4.2.orig/error.c	2009-08-22 02:31:31.000000000 +0000
+++ bash-4.2/error.c	2012-03-13 21:53:47.641008819 +0000
@@ -200,7 +200,11 @@
 
   va_end (args);
   if (exit_immediately_on_error)
-    exit_shell (1);
+    {
+      if (last_command_exit_value == 0)
+	last_command_exit_value = 1;
+      exit_shell (last_command_exit_value);
+    }
 }
 
 void
diff -Naur bash-4.2.orig/execute_cmd.c bash-4.2/execute_cmd.c
--- bash-4.2.orig/execute_cmd.c	2011-02-09 22:32:25.000000000 +0000
+++ bash-4.2/execute_cmd.c	2012-03-13 21:53:47.630008799 +0000
@@ -2196,6 +2196,7 @@
   if (ignore_return && cmd)
     cmd->flags |= CMD_IGNORE_RETURN;
 
+#if defined (JOB_CONTROL)
   lastpipe_flag = 0;
   begin_unwind_frame ("lastpipe-exec");
   lstdin = -1;
@@ -2215,15 +2216,19 @@
 	  lastpipe_jid = stop_pipeline (0, (COMMAND *)NULL);	/* XXX */
 	  add_unwind_protect (lastpipe_cleanup, lastpipe_jid);
 	}
-      cmd->flags |= CMD_LASTPIPE;
+      if (cmd)
+	cmd->flags |= CMD_LASTPIPE;
     }	  
   if (prev >= 0)
     add_unwind_protect (close, prev);
+#endif
 
   exec_result = execute_command_internal (cmd, asynchronous, prev, pipe_out, fds_to_close);
 
+#if defined (JOB_CONTROL)
   if (lstdin > 0)
     restore_stdin (lstdin);
+#endif
 
   if (prev >= 0)
     close (prev);
diff -Naur bash-4.2.orig/expr.c bash-4.2/expr.c
--- bash-4.2.orig/expr.c	2010-12-21 16:12:13.000000000 +0000
+++ bash-4.2/expr.c	2012-03-13 21:53:47.620008780 +0000
@@ -476,19 +476,23 @@
 
       if (special)
 	{
+	  if ((op == DIV || op == MOD) && value == 0)
+	    {
+	      if (noeval == 0)
+		evalerror (_("division by 0"));
+	      else
+	        value = 1;
+	    }
+
 	  switch (op)
 	    {
 	    case MUL:
 	      lvalue *= value;
 	      break;
 	    case DIV:
-	      if (value == 0)
-		evalerror (_("division by 0"));
 	      lvalue /= value;
 	      break;
 	    case MOD:
-	      if (value == 0)
-		evalerror (_("division by 0"));
 	      lvalue %= value;
 	      break;
 	    case PLUS:
@@ -804,7 +808,12 @@
       val2 = exppower ();
 
       if (((op == DIV) || (op == MOD)) && (val2 == 0))
-	evalerror (_("division by 0"));
+	{
+	  if (noeval == 0)
+	    evalerror (_("division by 0"));
+	  else
+	    val2 = 1;
+	}
 
       if (op == MUL)
 	val1 *= val2;
diff -Naur bash-4.2.orig/lib/glob/gmisc.c bash-4.2/lib/glob/gmisc.c
--- bash-4.2.orig/lib/glob/gmisc.c	2011-02-05 21:11:17.000000000 +0000
+++ bash-4.2/lib/glob/gmisc.c	2012-03-13 21:53:47.584008716 +0000
@@ -77,8 +77,8 @@
      wchar_t *wpat;
      size_t wmax;
 {
-  wchar_t wc, *wbrack;
-  int matlen, t, in_cclass, in_collsym, in_equiv;
+  wchar_t wc;
+  int matlen, bracklen, t, in_cclass, in_collsym, in_equiv;
 
   if (*wpat == 0)
     return (0);
@@ -118,58 +118,80 @@
 	  break;
 	case L'[':
 	  /* scan for ending `]', skipping over embedded [:...:] */
-	  wbrack = wpat;
+	  bracklen = 1;
 	  wc = *wpat++;
 	  do
 	    {
 	      if (wc == 0)
 		{
-	          matlen += wpat - wbrack - 1;	/* incremented below */
-	          break;
+		  wpat--;			/* back up to NUL */
+	          matlen += bracklen;
+	          goto bad_bracket;
 	        }
 	      else if (wc == L'\\')
 		{
-		  wc = *wpat++;
-		  if (*wpat == 0)
-		    break;
+		  /* *wpat == backslash-escaped character */
+		  bracklen++;
+		  /* If the backslash or backslash-escape ends the string,
+		     bail.  The ++wpat skips over the backslash escape */
+		  if (*wpat == 0 || *++wpat == 0)
+		    {
+		      matlen += bracklen;
+		      goto bad_bracket;
+		    }
 		}
 	      else if (wc == L'[' && *wpat == L':')	/* character class */
 		{
 		  wpat++;
+		  bracklen++;
 		  in_cclass = 1;
 		}
 	      else if (in_cclass && wc == L':' && *wpat == L']')
 		{
 		  wpat++;
+		  bracklen++;
 		  in_cclass = 0;
 		}
 	      else if (wc == L'[' && *wpat == L'.')	/* collating symbol */
 		{
 		  wpat++;
+		  bracklen++;
 		  if (*wpat == L']')	/* right bracket can appear as collating symbol */
-		    wpat++;
+		    {
+		      wpat++;
+		      bracklen++;
+		    }
 		  in_collsym = 1;
 		}
 	      else if (in_collsym && wc == L'.' && *wpat == L']')
 		{
 		  wpat++;
+		  bracklen++;
 		  in_collsym = 0;
 		}
 	      else if (wc == L'[' && *wpat == L'=')	/* equivalence class */
 		{
 		  wpat++;
+		  bracklen++;
 		  if (*wpat == L']')	/* right bracket can appear as equivalence class */
-		    wpat++;
+		    {
+		      wpat++;
+		      bracklen++;
+		    }
 		  in_equiv = 1;
 		}
 	      else if (in_equiv && wc == L'=' && *wpat == L']')
 		{
 		  wpat++;
+		  bracklen++;
 		  in_equiv = 0;
 		}
+	      else
+		bracklen++;
 	    }
 	  while ((wc = *wpat++) != L']');
 	  matlen++;		/* bracket expression can only match one char */
+bad_bracket:
 	  break;
 	}
     }
@@ -213,8 +235,8 @@
      char *pat;
      size_t max;
 {
-  char c, *brack;
-  int matlen, t, in_cclass, in_collsym, in_equiv;
+  char c;
+  int matlen, bracklen, t, in_cclass, in_collsym, in_equiv;
 
   if (*pat == 0)
     return (0);
@@ -254,58 +276,80 @@
 	  break;
 	case '[':
 	  /* scan for ending `]', skipping over embedded [:...:] */
-	  brack = pat;
+	  bracklen = 1;
 	  c = *pat++;
 	  do
 	    {
 	      if (c == 0)
 		{
-	          matlen += pat - brack - 1;	/* incremented below */
-	          break;
+		  pat--;			/* back up to NUL */
+		  matlen += bracklen;
+		  goto bad_bracket;
 	        }
 	      else if (c == '\\')
 		{
-		  c = *pat++;
-		  if (*pat == 0)
-		    break;
+		  /* *pat == backslash-escaped character */
+		  bracklen++;
+		  /* If the backslash or backslash-escape ends the string,
+		     bail.  The ++pat skips over the backslash escape */
+		  if (*pat == 0 || *++pat == 0)
+		    {
+		      matlen += bracklen;
+		      goto bad_bracket;
+		    }
 		}
 	      else if (c == '[' && *pat == ':')	/* character class */
 		{
 		  pat++;
+		  bracklen++;
 		  in_cclass = 1;
 		}
 	      else if (in_cclass && c == ':' && *pat == ']')
 		{
 		  pat++;
+		  bracklen++;
 		  in_cclass = 0;
 		}
 	      else if (c == '[' && *pat == '.')	/* collating symbol */
 		{
 		  pat++;
+		  bracklen++;
 		  if (*pat == ']')	/* right bracket can appear as collating symbol */
-		    pat++;
+		    {
+		      pat++;
+		      bracklen++;
+		    }
 		  in_collsym = 1;
 		}
 	      else if (in_collsym && c == '.' && *pat == ']')
 		{
 		  pat++;
+		  bracklen++;
 		  in_collsym = 0;
 		}
 	      else if (c == '[' && *pat == '=')	/* equivalence class */
 		{
 		  pat++;
+		  bracklen++;
 		  if (*pat == ']')	/* right bracket can appear as equivalence class */
-		    pat++;
+		    {
+		      pat++;
+		      bracklen++;
+		    }
 		  in_equiv = 1;
 		}
 	      else if (in_equiv && c == '=' && *pat == ']')
 		{
 		  pat++;
+		  bracklen++;
 		  in_equiv = 0;
 		}
+	      else
+		bracklen++;
 	    }
 	  while ((c = *pat++) != ']');
 	  matlen++;		/* bracket expression can only match one char */
+bad_bracket:
 	  break;
 	}
     }
diff -Naur bash-4.2.orig/lib/readline/callback.c bash-4.2/lib/readline/callback.c
--- bash-4.2.orig/lib/readline/callback.c	2010-06-06 16:18:58.000000000 +0000
+++ bash-4.2/lib/readline/callback.c	2012-03-13 21:53:47.583008715 +0000
@@ -148,6 +148,9 @@
 	  eof = _rl_vi_domove_callback (_rl_vimvcxt);
 	  /* Should handle everything, including cleanup, numeric arguments,
 	     and turning off RL_STATE_VIMOTION */
+	  if (RL_ISSTATE (RL_STATE_NUMERICARG) == 0)
+	    _rl_internal_char_cleanup ();
+
 	  return;
 	}
 #endif
diff -Naur bash-4.2.orig/lib/readline/vi_mode.c bash-4.2/lib/readline/vi_mode.c
--- bash-4.2.orig/lib/readline/vi_mode.c	2010-11-21 00:51:39.000000000 +0000
+++ bash-4.2/lib/readline/vi_mode.c	2012-03-13 21:53:47.582008713 +0000
@@ -1114,7 +1114,7 @@
       rl_beg_of_line (1, c);
       _rl_vi_last_motion = c;
       RL_UNSETSTATE (RL_STATE_VIMOTION);
-      return (0);
+      return (vidomove_dispatch (m));
     }
 #if defined (READLINE_CALLBACKS)
   /* XXX - these need to handle rl_universal_argument bindings */
diff -Naur bash-4.2.orig/lib/sh/zread.c bash-4.2/lib/sh/zread.c
--- bash-4.2.orig/lib/sh/zread.c	2009-03-02 13:54:45.000000000 +0000
+++ bash-4.2/lib/sh/zread.c	2012-03-13 21:53:47.637008811 +0000
@@ -160,14 +160,13 @@
 zsyncfd (fd)
      int fd;
 {
-  off_t off;
-  int r;
+  off_t off, r;
 
   off = lused - lind;
   r = 0;
   if (off > 0)
     r = lseek (fd, -off, SEEK_CUR);
 
-  if (r >= 0)
+  if (r != -1)
     lused = lind = 0;
 }
diff -Naur bash-4.2.orig/parse.y bash-4.2/parse.y
--- bash-4.2.orig/parse.y	2011-01-02 20:48:11.000000000 +0000
+++ bash-4.2/parse.y	2012-03-13 21:53:47.622008784 +0000
@@ -2499,7 +2499,7 @@
 	 We do this only if it is time to do so. Notice that only here
 	 is the mail alarm reset; nothing takes place in check_mail ()
 	 except the checking of mail.  Please don't change this. */
-      if (prompt_is_ps1 && time_to_check_mail ())
+      if (prompt_is_ps1 && parse_and_execute_level == 0 && time_to_check_mail ())
 	{
 	  check_mail ();
 	  reset_mail_timer ();
@@ -3842,6 +3842,7 @@
      int flags;
 {
   sh_parser_state_t ps;
+  sh_input_line_state_t ls;
   int orig_ind, nc, sflags;
   char *ret, *s, *ep, *ostring;
 
@@ -3849,10 +3850,12 @@
   orig_ind = *indp;
   ostring = string;
 
+/*itrace("xparse_dolparen: size = %d shell_input_line = `%s'", shell_input_line_size, shell_input_line);*/
   sflags = SEVAL_NONINT|SEVAL_NOHIST|SEVAL_NOFREE;
   if (flags & SX_NOLONGJMP)
     sflags |= SEVAL_NOLONGJMP;
   save_parser_state (&ps);
+  save_input_line_state (&ls);
 
   /*(*/
   parser_state |= PST_CMDSUBST|PST_EOFTOKEN;	/* allow instant ')' */ /*(*/
@@ -3861,6 +3864,8 @@
 
   restore_parser_state (&ps);
   reset_parser ();
+  /* reset_parser clears shell_input_line and associated variables */
+  restore_input_line_state (&ls);
   if (interactive)
     token_to_read = 0;
 
@@ -5135,6 +5140,9 @@
 	    case 'A':
 	      /* Make the current time/date into a string. */
 	      (void) time (&the_time);
+#if defined (HAVE_TZSET)
+	      sv_tz ("TZ");		/* XXX -- just make sure */
+#endif
 	      tm = localtime (&the_time);
 
 	      if (c == 'd')
@@ -5905,6 +5913,12 @@
   ps->expand_aliases = expand_aliases;
   ps->echo_input_at_read = echo_input_at_read;
 
+  ps->token = token;
+  ps->token_buffer_size = token_buffer_size;
+  /* Force reallocation on next call to read_token_word */
+  token = 0;
+  token_buffer_size = 0;
+
   return (ps);
 }
 
@@ -5946,6 +5960,42 @@
 
   expand_aliases = ps->expand_aliases;
   echo_input_at_read = ps->echo_input_at_read;
+
+  FREE (token);
+  token = ps->token;
+  token_buffer_size = ps->token_buffer_size;
+}
+
+sh_input_line_state_t *
+save_input_line_state (ls)
+     sh_input_line_state_t *ls;
+{
+  if (ls == 0)
+    ls = (sh_input_line_state_t *)xmalloc (sizeof (sh_input_line_state_t));
+  if (ls == 0)
+    return ((sh_input_line_state_t *)NULL);
+
+  ls->input_line = shell_input_line;
+  ls->input_line_size = shell_input_line_size;
+  ls->input_line_len = shell_input_line_len;
+  ls->input_line_index = shell_input_line_index;
+
+  /* force reallocation */
+  shell_input_line = 0;
+  shell_input_line_size = shell_input_line_len = shell_input_line_index = 0;
+}
+
+void
+restore_input_line_state (ls)
+     sh_input_line_state_t *ls;
+{
+  FREE (shell_input_line);
+  shell_input_line = ls->input_line;
+  shell_input_line_size = ls->input_line_size;
+  shell_input_line_len = ls->input_line_len;
+  shell_input_line_index = ls->input_line_index;
+
+  set_line_mbstate ();
 }
 
 /************************************************
diff -Naur bash-4.2.orig/patchlevel.h bash-4.2/patchlevel.h
--- bash-4.2.orig/patchlevel.h	2010-06-13 00:14:48.000000000 +0000
+++ bash-4.2/patchlevel.h	2012-03-13 21:53:47.644008825 +0000
@@ -25,6 +25,6 @@
    regexp `^#define[ 	]*PATCHLEVEL', since that's what support/mkversion.sh
    looks for to find the patch level (for the sccs version string). */
 
-#define PATCHLEVEL 0
+#define PATCHLEVEL 24
 
 #endif /* _PATCHLEVEL_H_ */
diff -Naur bash-4.2.orig/pathexp.c bash-4.2/pathexp.c
--- bash-4.2.orig/pathexp.c	2010-08-14 03:21:57.000000000 +0000
+++ bash-4.2/pathexp.c	2012-03-13 21:53:47.618008777 +0000
@@ -196,7 +196,7 @@
 	{
 	  if ((qflags & QGLOB_FILENAME) && pathname[i+1] == '/')
 	    continue;
-	  if ((qflags & QGLOB_REGEXP) && ere_char (pathname[i+1]) == 0)
+	  if (pathname[i+1] != CTLESC && (qflags & QGLOB_REGEXP) && ere_char (pathname[i+1]) == 0)
 	    continue;
 	  temp[j++] = '\\';
 	  i++;
diff -Naur bash-4.2.orig/print_cmd.c bash-4.2/print_cmd.c
--- bash-4.2.orig/print_cmd.c	2010-05-30 22:34:08.000000000 +0000
+++ bash-4.2/print_cmd.c	2012-03-13 21:53:47.608008760 +0000
@@ -315,6 +315,7 @@
 	  cprintf ("( ");
 	  skip_this_indent++;
 	  make_command_string_internal (command->value.Subshell->command);
+	  PRINT_DEFERRED_HEREDOCS ("");
 	  cprintf (" )");
 	  break;
 
@@ -592,6 +593,7 @@
   newline ("do\n");
   indentation += indentation_amount;
   make_command_string_internal (arith_for_command->action);
+  PRINT_DEFERRED_HEREDOCS ("");
   semicolon ();
   indentation -= indentation_amount;
   newline ("done");
@@ -653,6 +655,7 @@
     }
 
   make_command_string_internal (group_command->command);
+  PRINT_DEFERRED_HEREDOCS ("");
 
   if (inside_function_def)
     {
diff -Naur bash-4.2.orig/shell.h bash-4.2/shell.h
--- bash-4.2.orig/shell.h	2011-01-07 03:16:55.000000000 +0000
+++ bash-4.2/shell.h	2012-03-13 21:53:47.613008768 +0000
@@ -136,6 +136,9 @@
   int parser_state;
   int *token_state;
 
+  char *token;
+  int token_buffer_size;
+
   /* input line state -- line number saved elsewhere */
   int input_line_terminator;
   int eof_encountered;
@@ -166,6 +169,16 @@
   
 } sh_parser_state_t;
 
+typedef struct _sh_input_line_state_t {
+  char *input_line;
+  int input_line_index;
+  int input_line_size;
+  int input_line_len;
+} sh_input_line_state_t;
+
 /* Let's try declaring these here. */
 extern sh_parser_state_t *save_parser_state __P((sh_parser_state_t *));
 extern void restore_parser_state __P((sh_parser_state_t *));
+
+extern sh_input_line_state_t *save_input_line_state __P((sh_input_line_state_t *));
+extern void restore_input_line_state __P((sh_input_line_state_t *));
diff -Naur bash-4.2.orig/sig.c bash-4.2/sig.c
--- bash-4.2.orig/sig.c	2010-11-23 13:21:22.000000000 +0000
+++ bash-4.2/sig.c	2012-03-13 21:53:47.604008752 +0000
@@ -46,6 +46,7 @@
 
 #if defined (READLINE)
 #  include "bashline.h"
+#  include <readline/readline.h>
 #endif
 
 #if defined (HISTORY)
@@ -62,6 +63,7 @@
 #if defined (HISTORY)
 extern int history_lines_this_session;
 #endif
+extern int no_line_editing;
 
 extern void initialize_siglist ();
 
@@ -505,7 +507,10 @@
     {
 #if defined (HISTORY)
       /* XXX - will inhibit history file being written */
-      history_lines_this_session = 0;
+#  if defined (READLINE)
+      if (interactive_shell == 0 || interactive == 0 || (sig != SIGHUP && sig != SIGTERM) || no_line_editing || (RL_ISSTATE (RL_STATE_READCMD) == 0))
+#  endif
+        history_lines_this_session = 0;
 #endif
       terminate_immediately = 0;
       termsig_handler (sig);
diff -Naur bash-4.2.orig/subst.c bash-4.2/subst.c
--- bash-4.2.orig/subst.c	2011-01-02 21:12:51.000000000 +0000
+++ bash-4.2/subst.c	2012-03-13 21:53:47.640008817 +0000
@@ -1379,10 +1379,12 @@
   slen = strlen (string + *sindex) + *sindex;
 
   /* The handling of dolbrace_state needs to agree with the code in parse.y:
-     parse_matched_pair() */
-  dolbrace_state = 0;
-  if (quoted & (Q_HERE_DOCUMENT|Q_DOUBLE_QUOTES))
-    dolbrace_state = (flags & SX_POSIXEXP) ? DOLBRACE_QUOTE : DOLBRACE_PARAM;
+     parse_matched_pair().  The different initial value is to handle the
+     case where this function is called to parse the word in
+     ${param op word} (SX_WORD). */
+  dolbrace_state = (flags & SX_WORD) ? DOLBRACE_WORD : DOLBRACE_PARAM;
+  if ((quoted & (Q_HERE_DOCUMENT|Q_DOUBLE_QUOTES)) && (flags & SX_POSIXEXP))
+    dolbrace_state = DOLBRACE_QUOTE;
 
   i = *sindex;
   while (c = string[i])
@@ -3371,7 +3373,7 @@
   if (string == 0 || *string == '\0')
     return (WORD_LIST *)NULL;
 
-  td.flags = 0;
+  td.flags = W_NOSPLIT2;		/* no splitting, remove "" and '' */
   td.word = string;
   tresult = call_expand_word_internal (&td, quoted, 1, dollar_at_p, has_dollar_at);
   return (tresult);
@@ -3704,7 +3706,10 @@
 	    break;
 	}
       else if (string[i] == CTLNUL)
-	i++;
+	{
+	  i++;
+	  continue;
+	}
 
       prev_i = i;
       ADVANCE_CHAR (string, slen, i);
@@ -4607,6 +4612,7 @@
   if (ifs_firstc == 0)
 #endif
     word->flags |= W_NOSPLIT;
+  word->flags |= W_NOSPLIT2;
   result = call_expand_word_internal (word, quoted, 0, (int *)NULL, (int *)NULL);
   expand_no_split_dollar_star = 0;
 
@@ -7176,7 +7182,7 @@
     {
       /* Extract the contents of the ${ ... } expansion
 	 according to the Posix.2 rules. */
-      value = extract_dollar_brace_string (string, &sindex, quoted, (c == '%' || c == '#') ? SX_POSIXEXP : 0);
+      value = extract_dollar_brace_string (string, &sindex, quoted, (c == '%' || c == '#' || c =='/' || c == '^' || c == ',' || c ==':') ? SX_POSIXEXP|SX_WORD : SX_WORD);
       if (string[sindex] == RBRACE)
 	sindex++;
       else
@@ -7268,6 +7274,7 @@
     default:
     case '\0':
     bad_substitution:
+      last_command_exit_value = EXECUTION_FAILURE;
       report_error (_("%s: bad substitution"), string ? string : "??");
       FREE (value);
       FREE (temp);
diff -Naur bash-4.2.orig/subst.h bash-4.2/subst.h
--- bash-4.2.orig/subst.h	2010-12-03 01:21:29.000000000 +0000
+++ bash-4.2/subst.h	2012-03-13 21:53:47.580008709 +0000
@@ -56,6 +56,7 @@
 #define SX_NOLONGJMP	0x0040	/* don't longjmp on fatal error */
 #define SX_ARITHSUB	0x0080	/* extracting $(( ... )) (currently unused) */
 #define SX_POSIXEXP	0x0100	/* extracting new Posix pattern removal expansions in extract_dollar_brace_string */
+#define SX_WORD		0x0200	/* extracting word in ${param op word} */
 
 /* Remove backslashes which are quoting backquotes from STRING.  Modifies
    STRING, and returns a pointer to it. */
diff -Naur bash-4.2.orig/support/shobj-conf bash-4.2/support/shobj-conf
--- bash-4.2.orig/support/shobj-conf	2009-10-28 13:20:21.000000000 +0000
+++ bash-4.2/support/shobj-conf	2012-03-13 21:53:47.634008805 +0000
@@ -157,7 +157,7 @@
 	;;
 
 # Darwin/MacOS X
-darwin[89]*|darwin10*)
+darwin[89]*|darwin1[012]*)
 	SHOBJ_STATUS=supported
 	SHLIB_STATUS=supported
 	
@@ -186,7 +186,7 @@
 	SHLIB_LIBSUFF='dylib'
 
 	case "${host_os}" in
-	darwin[789]*|darwin10*)	SHOBJ_LDFLAGS=''
+	darwin[789]*|darwin1[012]*)	SHOBJ_LDFLAGS=''
 			SHLIB_XLDFLAGS='-dynamiclib -arch_only `/usr/bin/arch` -install_name $(libdir)/$@ -current_version $(SHLIB_MAJOR)$(SHLIB_MINOR) -compatibility_version $(SHLIB_MAJOR) -v'
 			;;
 	*)		SHOBJ_LDFLAGS='-dynamic'
diff -Naur bash-4.2.orig/variables.c bash-4.2/variables.c
--- bash-4.2.orig/variables.c	2011-01-25 01:07:48.000000000 +0000
+++ bash-4.2/variables.c	2012-03-13 21:53:47.598008741 +0000
@@ -3653,6 +3653,22 @@
   return n;
 }
 
+int
+chkexport (name)
+     char *name;
+{
+  SHELL_VAR *v;
+
+  v = find_variable (name);
+  if (v && exported_p (v))
+    {
+      array_needs_making = 1;
+      maybe_make_export_env ();
+      return 1;
+    }
+  return 0;
+}
+
 void
 maybe_make_export_env ()
 {
@@ -4214,7 +4230,7 @@
   { "TEXTDOMAIN", sv_locale },
   { "TEXTDOMAINDIR", sv_locale },
 
-#if defined (HAVE_TZSET) && defined (PROMPT_STRING_DECODE)
+#if defined (HAVE_TZSET)
   { "TZ", sv_tz },
 #endif
 
@@ -4558,12 +4574,13 @@
 }
 #endif /* HISTORY */
 
-#if defined (HAVE_TZSET) && defined (PROMPT_STRING_DECODE)
+#if defined (HAVE_TZSET)
 void
 sv_tz (name)
      char *name;
 {
-  tzset ();
+  if (chkexport (name))
+    tzset ();
 }
 #endif
 
diff -Naur bash-4.2.orig/variables.h bash-4.2/variables.h
--- bash-4.2.orig/variables.h	2010-12-03 01:22:01.000000000 +0000
+++ bash-4.2/variables.h	2012-03-13 21:53:47.590008727 +0000
@@ -313,6 +313,7 @@
 
 extern void sort_variables __P((SHELL_VAR **));
 
+extern int chkexport __P((char *));
 extern void maybe_make_export_env __P((void));
 extern void update_export_env_inplace __P((char *, int, char *));
 extern void put_command_name_into_env __P((char *));
