From sanewo@sanewo.ba2.so-net.or.jp  Wed Jun  4 14:56:09 1997
Received: from sanewo.ba2.so-net.or.jp (pppba4b.pppp.ap.so-net.or.jp [210.132.186.75])
          by hub.freebsd.org (8.8.5/8.8.5) with ESMTP id OAA15308
          for <FreeBSD-gnats-submit@freebsd.org>; Wed, 4 Jun 1997 14:56:07 -0700 (PDT)
Received: (from sanewo@localhost) by sanewo.ba2.so-net.or.jp (8.8.5/8.7.3) id GAA20600; Thu, 5 Jun 1997 06:51:47 +0900 (JST)
Message-Id: <199706042151.GAA20600@sanewo.ba2.so-net.or.jp>
Date: Thu, 5 Jun 1997 06:51:47 +0900 (JST)
From: sanewo@ba2.so-net.or.jp
Reply-To: sanewo@ba2.so-net.or.jp
To: FreeBSD-gnats-submit@freebsd.org
Subject: WEXITSTATUS() may return nagative value, which causes sh to generate bad $?
X-Send-Pr-Version: 3.2

>Number:         3780
>Category:       bin
>Synopsis:       WEXITSTATUS() may return nagative value, which causes sh to generate bad $?
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    steve
>State:          closed
>Quarter:
>Keywords:
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Jun  4 15:00:03 PDT 1997
>Closed-Date:    Mon Aug 18 10:27:08 PDT 1997
>Last-Modified:  Mon Aug 18 10:32:34 PDT 1997
>Originator:     Takanori Saneto
>Release:        FreeBSD 3.0-CURRENT i386
>Organization:
an individual
>Environment:

	current as of June 1 1997.

>Description:

	When subprocess of /bin/sh exit(2)s with negative argument, the value of $? bacomes
	bad. (-/ instead of -1, for example)

>How-To-Repeat:

	# /bin/sh -c 'perl -e "exit -1"; echo $?'
	-/

>Fix:

*** bin/sh/expand.c.org	Thu Jun  5 06:45:18 1997
--- bin/sh/expand.c	Thu Jun  5 06:45:43 1997
***************
*** 1388,1393 ****
--- 1388,1394 ----
  
  	temp[31] = '\0';
  
+ 	if (neg) num = -num;
  	do {
  		*--p = num % 10 + '0';
  	} while ((num /= 10) != 0);

BTW, should WEXITSTATUS() return unsigned value? (I don't know what POSIX says about this)
>Release-Note:
>Audit-Trail:

From: Bruce Evans <bde@zeta.org.au>
To: FreeBSD-gnats-submit@FreeBSD.ORG, sanewo@ba2.so-net.or.jp
Cc:  Subject: Re: bin/3780: WEXITSTATUS() may return nagative value, which causes sh to generate bad $?
Date: Thu, 5 Jun 1997 09:25:08 +1000

 >BTW, should WEXITSTATUS() return unsigned value? (I don't know what POSIX says about this)
 
 WEXITSTATUS returns an 8-bit value, but is only valid on values return
 by wait().  sh corrupts these values by storing them in ps->status
 which has type short.  This happens not to lose information under
 FreeBSD, but it causes some sign extension problems.  When a process
 exits with the bogus status of -1, -1 first gets corrupted to 0xff.
 Then on 32-bit little-endian 2's complement machines, wait(&status) in
 the parent process stores 0xff00 in the int `status'.  (short)0xff00 is
 (int)0xffffff00 and shifting this in WEXITSTATUS() gives (int)0xffffffff.
 
 POSIX.1 requires the arg to WEXITSTATUS() to be `the integer value
 pointed to by stat_loc'.  I interpret this as saying that the arg must
 have integral type and the same value as the `int' that stat_loc once
 pointed to.
 
 I tried WEXITSTATUS((short)status) to test this, but the macro failed at
 compile time.  The wait macros seem to be non-POSIX conformant in the non-
 _POSIX_SOURCE case because of the crufty (*(int *)&(w)) conversion doesn't
 work unless `w' is an lvalue of type `int'.
 
 sh also stores pids in variables of type short.  This happens not to lose
 information under FreeBSD (because PID_MAX is 30000).
 
 Bruce
State-Changed-From-To: open->closed 
State-Changed-By: jkh 
State-Changed-When: Thu Jun 19 08:14:26 PDT 1997 
State-Changed-Why:  
Fix now in 3.0 and 2.2 - thanks! 
State-Changed-From-To: closed->open 
State-Changed-By: jkh 
State-Changed-When: Thu Jun 19 13:49:50 PDT 1997 
State-Changed-Why:  
Put this PR back into limbo. 
State-Changed-From-To: open->closed 
State-Changed-By: steve 
State-Changed-When: Mon Aug 18 10:27:08 PDT 1997 
State-Changed-Why:  
Fixed in revision 1.16 of jobs.c and revision 1.6 of jobs.h. 
Well this fix at least gets us bug for bug compatible with the 
Korn shell. 
>Unformatted:
