https://bugs.gentoo.org/600174 https://lists.gnu.org/archive/html/bug-bash/2016-11/msg00099.html *** bash-4.4/builtins/pushd.def --- bash-4.4/builtins/pushd.def *************** *** 366,370 **** } ! if (which > directory_list_offset || (directory_list_offset == 0 && which == 0)) { pushd_error (directory_list_offset, which_word ? which_word : ""); --- 366,370 ---- } ! if (which > directory_list_offset || (which < -directory_list_offset) || (directory_list_offset == 0 && which == 0)) { pushd_error (directory_list_offset, which_word ? which_word : ""); *************** *** 388,391 **** --- 388,396 ---- of the list into place. */ i = (direction == '+') ? directory_list_offset - which : which; + if (i < 0 || i > directory_list_offset) + { + pushd_error (directory_list_offset, which_word ? which_word : ""); + return (EXECUTION_FAILURE); + } free (pushd_directory_list[i]); directory_list_offset--;