***************************************************
MEMO TO USERS = NONE
ENDSET
APARTXT IX46667 = CSH INTERNAL (MEMORY) CORRUPTION
 /usr/bin/csh sometimes corrupts its own address
 space [[ malloc()ed memory ]] when the argument
 to the built-in cd command ends in a slash.
 Such corruption happens to the first slash in
 malloc()ed memory that follows the NULL-terminating
 byte of the directory-name if-and-only-if there is
 no NULL-byte between the directory-name
 NULL-terminator and the slash.
 This bug becomes evident to the users when the value
 of an environment variable which contains the slash
 character becomes truncated at the slash.
 This very old bug was inherited from BSD-csh and
 it exist in all BSD-based versions of the csh.
APARTXT IX47005 = libc_r.a not updated with libc.a
 There was a missing symbol in libc.a.
 The symbol is _ypserv_timeout. This symbol
 is imported by libc_r.a. This prevents
 libc_r.a from loading.
APARTXT IX48684 = GPROF RECORDS TIME AGAINST WRONG FUNCTION
 gprof shows time recorded against the wrong function
APARTXT IX48315 = FCLOSE() MEMORY LEAK
 There is a memory leak in fflush()/fclose() call. The program
 leaks memory for the stream buffer procured during an fgets()
 call if the program performs a fclose() after an close() system
 call. This behaviour was introduced when the fclose()/fflush()
 was changed to be XPG4 complaint.  The fclose() simply returns
 an error if the underlying file descriptor is closed.
APARTXT IX48234 = AIX 3.2 MBIN/CSH, AIX 4.1 CSH: Q-MODIFIER
 This problem is common to AIX 3.2 multi-byte C-shell and
 to AIX 4.1 C-shell.  The C-shell performs incorrect
 expansion for the q-Modifier when dealing with quoted
 strings.  Testcase follows
 :::::::::::::::::::::::::::::::::::::::::::::::::::::
 # correct output is "some string" (with double-quote)
 set tmp = "./tmp$$"
 set dq = '"'
 set string = "some string"
 echo "${dq:q}${string:q}${dq:q}"
 :::::::::::::::::::::::::::::::::::::::::::::::::::::
APARTXT IX48142 = CSH: HEREDOCUMENT & ESCAPING MARKER WORD
 In the csh, the '<<' symbol specifies in-line input
 redirection. The 'marker word' indicates the beginning
 and end of the input. The csh incorrectly perform
 variable and command substitution on the intervening
 lines when the 'marker word' contains the backslash
 (escape) character.
APARTXT IX48341 = GETPWUID GOES TO YELLOW-PAGES UN-NECESSARILY
 apar ix41879 optimized getpwuid() when multiple
 +userName yellow-page entries exist in /etc/passwd.
 Apar ix43517 is a follow-up to ix41879 which corrects
 a glitch of bypassing the yellow-page directive +::::::
 Now, the problem at hand introduced by ix41879 is an
 un-necessary yellow-page request when such request will
 be serviced locally.
APARTXT IX51150 = CSH RETURNS WRONG ERROR MESSAGE FROM KILL BUILTIN
 The "csh" builtin command "kill" produces an incorrect
 error message when the process ID being killed is invalid.
APARTXT IX52246 = fileno doesnot return -1 for a NULL file pointer
 fileno doesnot return -1 for null file pointer
APARTXT IX52918 = SEEKDIR BROKEN ON FS WITH DIRBLKSIZ !=512
 When using a fileserver whose DIRBLKSIZ is not 512
 (i.e. HP's is 1024), the seekdir routine incorrectly
 sets the position of the next readdir() operation.
APARTXT IX53515 = APAR IX48341 BROKE GETPWUID
 AIX apar ix48341 (3.2.5) or ix51415 (4.1.3) concerned
 the unnecessary call to getuidfromyellow. The solution
 to ix48341/ix51415 was to invoke getuidfromyellow only
 if necessary.
 The problem now at hand is that both
 (1) getuidfromyellow, and
 (2) interpret
 use the same static buffer and calling getuidfromyellow
 from within the fgets-loop (which uses interpret) causes
 an overwrite of the data structure being manipulated
 by the loop.
 This problem is experienced when parsing /etc/passwd lines
 which begin with plus/minus and are followed by username.
APARTXT IX54907 = FETCHPW CORE-DUMPS AFTER APAR IX50912 IFF MKPASSWD
 If 'mkpasswd passwd' has been enabled,
 the library routine fetchpw core dumps.
 HOW TO REPLICATE
 (1) cd /etc
 (2) mkpasswd passwd
 (3) /usr/bin/ls -l ## the command ls will core-dump
 Executing the command
 what /usr/ccs/lib/libc.a | grep lib/c/s/getpwent
 will yield an sccsid of 1.50, 1.51, or 1.52
APARTXT IX54596 = FREEMINUSLIST CORE-DUMPS
 Under certain circumstances, when executing the
 command mkuser, the routine freeminuslist coredumps.
 BACKTRACE ( for command /usr/bin/mkuser )
 freeminuslist
 endpwent
 chknameexist
 chkname
 main
APARTXT IX54918 = ENDNETGRENT CORE-DUMPS
 Under certain circumstances, when executing the command
 mkuser, the routine endnetgrent coredumps. BACKTRACE ( for
 command /usr/bin/mkuser ) main -> chkname -> chknameexist ->
 getpwent -> -> _getpwent -> endnetgrent
ENDSET
COMPID FOR PTF U440687 = 575603001,320
PRODID FOR PTF U440687 = 5756030,C Shell
PREREQ FOR U440687 = U422437.575603001 U424153.575603001
 U434995
ENDSET
COREQ FOR U440687 = NONE
ENDSET
SUP FOR U440687 = U436409 U436776 U436967 U437423
 U437431 U437730 U438626 U439149
 U439365 U440185 U440753
ENDSET
IFREQ FOR U440687 = NONE
ENDSET
LABELTXT
Subsystem Fix Pkg
For use on AIX V3.2 only
ENDSET
***************************************************
