Merge branch 'busybox' into merge

Conflicts:
	archival/libarchive/open_transformer.c
	libbb/lineedit.c
	miscutils/man.c

2 files changed, 32 insertions, 5 deletions

diff --git a/shell/ash.c b/shell/ash.c
index 3f3e2f4bc..b95356034 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -6740,7 +6740,15 @@ subevalvar(char *p, char *varname, int strloc, int subtype,
                                 len = number(loc);
                         }
                 }
-                if (pos >= orig_len) {
+                if (pos < 0) {
+                        /* ${VAR:$((-n)):l} starts n chars from the end */
+                        pos = orig_len + pos;
+                }
+                if ((unsigned)pos >= orig_len) {
+                        /* apart from obvious ${VAR:999999:l},
+                         * covers ${VAR:$((-9999999)):l} - result is ""
+                         * (bash-compat)
+                         */
                         pos = 0;
                         len = 0;
                 }
diff --git a/shell/math.c b/shell/math.c
index 3da151137..006221b6a 100644
--- a/shell/math.c
+++ b/shell/math.c
@@ -415,10 +415,29 @@ arith_apply(arith_state_t *math_state, operator op, var_or_num_t *numstack, var_
                 }
                 else if (right_side_val == 0)
                         return "divide by zero";
-                else if (op == TOK_DIV || op == TOK_DIV_ASSIGN)
-                        rez /= right_side_val;
-                else if (op == TOK_REM || op == TOK_REM_ASSIGN)
-                        rez %= right_side_val;
+                else if (op == TOK_DIV || op == TOK_DIV_ASSIGN
+                      || op == TOK_REM || op == TOK_REM_ASSIGN) {
+                        /*
+                         * bash 4.2.45 x86 64bit: SEGV on 'echo $((2**63 / -1))'
+                         *
+                         * MAX_NEGATIVE_INT / -1 = MAX_POSITIVE_INT+1
+                         * and thus is not representable.
+                         * Some CPUs segfault trying such op.
+                         * Others overflow MAX_POSITIVE_INT+1 to
+                         * MAX_NEGATIVE_INT (0x7fff+1 = 0x8000).
+                         * Make sure to at least not SEGV here:
+                         */
+                        if (right_side_val == -1
+                         && rez << 1 == 0 /* MAX_NEGATIVE_INT or 0 */
+                        ) {
+                                right_side_val = 1;
+                        }
+                        if (op == TOK_DIV || op == TOK_DIV_ASSIGN)
+                                rez /= right_side_val;
+                        else {
+                                rez %= right_side_val;
+                        }
+                }
         }
 
         if (is_assign_op(op)) {