Merge branch 'dev' into fix-builtins-useafterfree

NEWS

@@ -4,6 +4,11 @@ Uppercase BUG_* IDs are shell bug IDs as used by the Modernish shell library.
 
 2025-01-05:
 
+- Fixed a crash that could occur if a discipline function was first assigned
+  to a variable in a virtual subshell before the variable was scoped to that
+  subshell, then upon subshell completion another discipline function of the
+  same type was assigned to that selfsame variable in the parent shell.
+
 - Fixed a crash that could occur in some scenarios when /opt/ast/bin
   builtins handled invalid options in virtual subshells.
 

src/cmd/ksh93/sh/nvtype.c

@@ -481,8 +481,8 @@ static Namval_t *create_type(Namval_t *np,const char *name,int flag,Namfun_t *fp
 	n = (cp-1) -name;
 	if(dp->numnodes && dp->strsize<0)
 	{
-		char *base =  (char*)np-sizeof(Dtlink_t);
-		int m=strlen(np->nvname);
+		char *base =  (char*)np-(NV_MINSZ-sizeof(Dtlink_t));
+		size_t m=strlen(np->nvname);
 		while((nq=nv_namptr(base,++i)) && strncmp(nq->nvname,np->nvname,m)==0)
 		{
 			if(nq->nvname[m]=='.' && strncmp(name,&nq->nvname[m+1],n)==0 && nq->nvname[m+n+1]==0)

src/cmd/ksh93/sh/xec.c

@@ -2382,7 +2382,14 @@ int sh_exec(const Shnode_t *t, int flags)
 			if(npv)
 			{
 				if(!sh.mktype)
+				{	/*
+					 * Set the discipline function. If this is done in a subshell, the variable
+					 * must be scoped to the subshell before nvfun is set to the discipline.
+					 */
+					if(sh.subshell && !sh.subshare)
+						sh_assignok(npv, 1);
 					cp = nv_setdisc(npv,cp,np,(Namfun_t*)npv);
+				}
 				if(!cp)
 				{
 					errormsg(SH_DICT,ERROR_exit(1),e_baddisc,fname);