Fix possible out-of-bounds call to free()

The rl_filename_completion_function() may theoretically step out of
bounds and call free on random pointers.  Found by Coverity Scan.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

.github/workflows/build.yml

@@ -0,0 +1,38 @@
+name: Bob the Builder
+
+# Run on all branches, including all pull requests, except the 'dev'
+# branch which we use for Coverity Scan (limited tokens/day)
+on:
+  push:
+    branches:
+      - '**'
+      - '!dev'
+  pull_request:
+    branches:
+      - '**'
+
+jobs:
+  build:
+    name: ${{ matrix.compiler }}
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        compiler: [gcc, clang]
+      fail-fast: false
+    env:
+      MAKEFLAGS: -j3
+      CC: ${{ matrix.compiler }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Configure
+        run: |
+          ./autogen.sh
+          ./configure --prefix= --disable-silent-rules \
+                      --enable-sigstop --enable-terminal-bell
+      - name: Build
+        run: |
+          make
+      - name: Install to ~/tmp and Inspect
+        run: |
+          DESTDIR=~/tmp make install-strip
+          ls -lR ~/tmp

.github/workflows/coverity.yml

@@ -0,0 +1,76 @@
+name: Coverity Scan
+
+on:
+  push:
+    branches:
+      - 'dev'
+
+env:
+  PROJECT_NAME: editline
+  CONTACT_EMAIL: troglobit@gmail.com
+  COVERITY_NAME: troglobit-editline
+  COVERITY_PROJ: troglobit%2Feditline
+
+jobs:
+  coverity:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Fetch latest Coverity Scan MD5
+        id: var
+        env:
+          TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
+        run: |
+          wget -q https://scan.coverity.com/download/cxx/linux64         \
+               --post-data "token=$TOKEN&project=${COVERITY_PROJ}&md5=1" \
+               -O coverity-latest.tar.gz.md5
+          echo "md5=$(cat coverity-latest.tar.gz.md5)" | tee -a $GITHUB_OUTPUT
+      - uses: actions/cache@v4
+        id: cache
+        with:
+          path: coverity-latest.tar.gz
+          key: ${{ runner.os }}-coverity-${{ steps.var.outputs.md5 }}
+          restore-keys: |
+            ${{ runner.os }}-coverity-${{ steps.var.outputs.md5 }}
+            ${{ runner.os }}-coverity-
+            ${{ runner.os }}-coverity
+      - name: Download Coverity Scan
+        env:
+          TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
+        run: |
+          if [ ! -f coverity-latest.tar.gz ]; then
+            wget -q https://scan.coverity.com/download/cxx/linux64   \
+                 --post-data "token=$TOKEN&project=${COVERITY_PROJ}" \
+                 -O coverity-latest.tar.gz
+          else
+            echo "Latest Coverity Scan available from cache :-)"
+            md5sum coverity-latest.tar.gz
+          fi
+          mkdir coverity
+          tar xzf coverity-latest.tar.gz --strip 1 -C coverity
+      - name: Configure
+        run: |
+          ./autogen.sh
+          ./configure --prefix= --enable-sigstop --enable-terminal-bell --enable-examples
+      - name: Build
+        run: |
+          export PATH=`pwd`/coverity/bin:$PATH
+          cov-build --dir cov-int make
+      - name: Submit results to Coverity Scan
+        env:
+          TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
+        run: |
+          tar czvf ${PROJECT_NAME}.tgz cov-int
+          curl \
+            --form project=${COVERITY_NAME} \
+            --form token=$TOKEN \
+            --form email=${CONTACT_EMAIL} \
+            --form file=@${PROJECT_NAME}.tgz \
+            --form version=trunk \
+            --form description="${PROJECT_NAME} $(git rev-parse HEAD)" \
+            https://scan.coverity.com/builds?project=${COVERITY_PROJ}
+      - name: Upload build.log
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverity-build.log
+          path: cov-int/build-log.txt

.github/workflows/release.yml

@@ -0,0 +1,33 @@
+name: Release General
+
+on:
+  push:
+    tags:
+      - '[0-9]+.[0-9]+*'
+
+jobs:
+  release:
+    name: Build and upload release tarball
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Creating Makefiles ...
+        run: |
+          ./autogen.sh
+          ./configure --prefix=
+      - name: Build release ...
+        run: |
+          make release
+          mkdir -p artifacts/
+          mv ../*.tar.* artifacts/
+      - name: Extract ChangeLog entry ...
+        run: |
+          awk '/-----*/{if (x == 1) exit; x=1;next}x' ChangeLog.md \
+              |head -n -1 > release.md
+          cat release.md
+      - uses: ncipollo/release-action@v1
+        with:
+          name: Editline v${{ github.ref_name }}
+          bodyFile: "release.md"
+          artifacts: "artifacts/*"

.travis.yml

@@ -1,34 +0,0 @@
-# Travis CI integration
-# Defaults to GNU GCC and autotools: ./configure && make && make test
-language: c
-
-# We don't need to install packages, use dockerized build, quicker
-sudo: false
-
-# Test build with both GCC and Clang (LLVM)
-compiler:
-  - gcc
-  - clang
-
-env:
-  global:
-   # The next declaration is the encrypted COVERITY_SCAN_TOKEN, created
-   #   via the "travis encrypt" command using the project repo's public key
-   - secure: "iFll6pD0lzVYVRUlbPBGOTB0xqoEsC0BeUdftfRQdnEssruWOEKtf3VH6gSNRu8QMPeTCNhl4fsWUJhnowZgoobi/XcsXxFv/oJQZ1sa7cQUXizeEYUmsDZxUiw/sNsWlUz6dBKPepQStYyOK/tJLQ1GfLi1ESTPt6anokMVDbk="
-
-addons:
-  coverity_scan:
-    project:
-      name: "troglobit/editline"
-      description: "A small line editing library"
-    notification_email: troglobit@gmail.com
-    build_command_prepend: "./autogen.sh && ./configure --enable-sigstop --enable-terminal-bell"
-    build_command:   "make clean all"
-    branch_pattern: dev
-
-# We don't store generated files (configure and Makefile) in GIT,
-# so we must customize the default build script to run ./autogen.sh
-script:
-  - ./autogen.sh
-  - ./configure --enable-sigstop --enable-terminal-bell 
-  - make clean all

Makefile.am

@@ -8,17 +8,9 @@ if ENABLE_EXAMPLES
 SUBDIRS            += examples
 endif
 
-## Generate MD5 checksum file
-MD5 = md5sum
-md5-dist:
-	@for file in $(DIST_ARCHIVES); do	\
-		$(MD5) $$file > ../$$file.md5;	\
-		mv $$file ../;			\
-	done
-
 ## Check if tagged in git
 release-hook:
-	if [ ! `git tag | grep $(PACKAGE_VERSION)` ]; then				\
+	if [ ! `git tag | grep $(PACKAGE_VERSION) | grep $(PACKAGE_VERSION)` ]; then	\
 		echo;									\
 		printf "\e[1m\e[41mCannot find release tag $(PACKAGE_VERSION)\e[0m\n";	\
 		printf "\e[1m\e[5mDo release anyway?\e[0m "; read yorn;			\
@@ -39,13 +31,19 @@ package:
 	dpkg-buildpackage -uc -us -B
 
 ## Target to run when building a release
-release: release-hook distcheck md5-dist package
+release: release-hook distcheck
+	@for file in $(DIST_ARCHIVES); do						\
+		md5sum    $$file > ../$$file.md5;					\
+		sha256sum $$file > ../$$file.sha256;					\
+	done
+	@mv $(DIST_ARCHIVES) ../
 	@echo
 	@echo "Resulting release files:"
 	@echo "========================================================================="
 	@for file in $(DIST_ARCHIVES); do						\
 		printf "%-40s Distribution tarball\n" $$file;				\
-		printf "%-40s " $$file.md5; cat ../$$file.md5 | cut -f1 -d' ';		\
+		printf "%-40s " $$file.md5;    cat ../$$file.md5    | cut -f1 -d' ';	\
+		printf "%-40s " $$file.sha256; cat ../$$file.sha256 | cut -f1 -d' ';	\
 	done
 	@for file in `cd ..; ls *$(PACKAGE)*_$(subst _,.,$(VERSION))*`; do		\
 		printf "%-40s Debian/Ubuntu package file\n" $$file;			\

README.md

@@ -1,6 +1,6 @@
 Editline
 ========
-[![License Badge][]][License] [![Travis Status]][Travis] [![Coverity Status]][Coverity Scan]
+[![License Badge][]][License] [![GitHub Status][]][GitHub] [![Coverity Status]][Coverity Scan]
 
 
 Table of Contents
@@ -31,7 +31,7 @@ supplying different options to the GNU configure script.  See the output
 from <kbd>configure --help</kbd> for details.  Some useful hints on how
 to use the library is available in the `examples/` directory.
 
-Editline is maintained collaboratively at [GitHub][].
+Editline is maintained collaboratively at [GitHub][1].
 
 > **Note:** Windows is not a supported target for editline.
 
@@ -251,7 +251,7 @@ efforts.
 
 Outstanding issues are listed in the [TODO.md][] file.
 
-[GitHub]:          https://github.com/troglobit/editline
+[1]:               https://github.com/troglobit/editline
 [line editing]:    https://github.com/troglobit/editline/blob/master/docs/README
 [release tarball]: https://github.com/troglobit/editline/releases
 [maintainer]:      http://troglobit.com
@@ -270,7 +270,7 @@ Outstanding issues are listed in the [TODO.md][] file.
 [Steve Tell]:      http://www.cs.unc.edu/~tell/dist.html
 [License]:         https://github.com/troglobit/editline/blob/master/LICENSE
 [License Badge]:   https://img.shields.io/badge/License-C%20News-orange.svg
-[Travis]:          https://travis-ci.org/troglobit/editline
+[GitHub]:          https://github.com/troglobit/editline/actions/workflows/build.yml/
-[Travis Status]:   https://travis-ci.org/troglobit/editline.png?branch=master
+[GitHub Status]:   https://github.com/troglobit/editline/actions/workflows/build.yml/badge.svg
 [Coverity Scan]:   https://scan.coverity.com/projects/2982
 [Coverity Status]: https://scan.coverity.com/projects/2982/badge.svg

configure.ac

@@ -1,11 +1,11 @@
-AC_INIT(editline, 1.17.1, https://github.com/troglobit/editline/issues)
+AC_INIT(editline, 1.17.2-pre, https://github.com/troglobit/editline/issues)
 AC_CONFIG_AUX_DIR(aux)
 AM_INIT_AUTOMAKE([1.11 foreign dist-xz])
 AM_SILENT_RULES([yes])
 
 AC_CONFIG_MACRO_DIR([m4])
 AC_CONFIG_SRCDIR([src/editline.c])
-AC_CONFIG_HEADER([config.h])
+AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_FILES([Makefile libeditline.pc src/Makefile include/Makefile man/Makefile examples/Makefile])
 
 # Checks for programs.
@@ -18,7 +18,7 @@ LT_INIT
 # Checks for header files.
 AC_HEADER_DIRENT
 AC_HEADER_STAT
-AC_HEADER_STDC
+
 # Check for malloc.h instead of AC_FUNC_MALLOC/REALLOC AIX and others
 # mess up the traditional malloc check.
 AC_CHECK_HEADERS([malloc.h signal.h stdlib.h string.h termcap.h termio.h termios.h sgtty.h unistd.h])
@@ -62,7 +62,7 @@ AC_ARG_ENABLE(termcap,
    AS_HELP_STRING([--enable-termcap], [Use termcap library to query terminal size.]))
 
 AC_ARG_ENABLE([examples],
-	[AC_HELP_STRING([--enable-examples], [Build examples/ directory])],
+	[AS_HELP_STRING([--enable-examples], [Build examples/ directory])],
 	[], [enable_examples=no])
 
 #
@@ -100,7 +100,8 @@ AS_IF([test "x$enable_termcap" = "xyes"], [
                ])
             ])
          ])
-      ])])
+      ])
+    ])
 
 # Generate all files
 AC_OUTPUT

examples/fileman.c

@@ -62,8 +62,8 @@ struct cmd commands[] = {
 };
 
 /* Forward declarations. */
-char *stripwhite();
+char *stripwhite(char *string);
-struct cmd *find_command();
+struct cmd *find_command(char *name);
 
 /* ~/.fileman_history */
 char *fileman_history;

src/complete.c

@@ -273,13 +273,21 @@ char *rl_filename_completion_function(const char *text, int state)
 	}
     }
 
-    do {
+    while (i > 0)
 	free(av[--i]);
-    } while (i > 0);
 
-    free(av);
+    if (av) {
-    free(dir);
+	free(av);
-    free(file);
+	av = NULL;
+    }
+    if (dir) {
+	free(dir);
+	dir = NULL;
+    }
+    if (file) {
+	free(file);
+	file = NULL;
+    }
 
     return NULL;
 }

src/editline.c

@@ -1431,7 +1431,7 @@ void rl_clear_message(void)
     /* Nothing to do atm. */
 }
 
-void rl_forced_update_display()
+void rl_forced_update_display(void)
 {
     redisplay(0);
     tty_flush();