lib/60570: [libedit] Possible NULL dereference in stifle_history

["loganjerry%gmail.com@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60570
>Category:       lib
>Synopsis:       [libedit] Possible NULL dereference in stifle_history
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    lib-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Aug 10 19:45:00 +0000 2026
>Originator:     Jerry James
>Release:        11.0
>Organization:
>Environment:
Linux diannao.lan 7.1.7-200.fc44.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Aug  6 21:13:02 UTC 2026 x86_64 GNU/Linux
>Description:
I maintain the libedit package for the Fedora Linux distribution, thanks to Jess Thrysoee's port. The remove_history function can return NULL; e.g., if memory allocation fails. However, the code in stifle_history assumes the return value is non-NULL. The included patch adds the missing NULL check prior to dereferencing the pointer.
>How-To-Repeat:
Actually causing a crash is difficult. This is just my attempt at eliminating a theoretically possible crash.
>Fix:
Index: lib/libedit/readline.c
===================================================================
RCS file: /cvsroot/src/lib/libedit/readline.c,v
retrieving revision 1.184
diff -u -r1.184 readline.c
--- lib/libedit/readline.c	9 Jan 2026 17:49:12 -0000	1.184
+++ lib/libedit/readline.c	10 Aug 2026 19:20:18 -0000
@@ -1246,9 +1246,11 @@
 			history_base = history_length - max;
 		while (history_length > max) {
 			he = remove_history(0);
-			el_free(he->data);
-			el_free((void *)(unsigned long)he->line);
-			el_free(he);
+			if (he != NULL) {
+				el_free(he->data);
+				el_free((void *)(unsigned long)he->line);
+				el_free(he);
+			}
 		}
 	}
 }