app-shells/bash: add 5.2_p32

Compared to bash-5.2_p26-memory-leaks.patch, this drops a hunk for
builtins/evalstring.c as the open_redir_file issue is fixed in patch 31
upstream for bash-5.2.

Signed-off-by: Sam James <sam@gentoo.org>

3 files changed, 544 insertions, 0 deletions

diff --git a/app-shells/bash/Manifest b/app-shells/bash/Manifest
index ead9a19e1f87..3789c5267d46 100644
--- a/app-shells/bash/Manifest
+++ b/app-shells/bash/Manifest
@@ -433,3 +433,15 @@ DIST bash52-025 1454 BLAKE2B 5d18e00cc44710f078037f25c61741a078bb0fc906d6d5555e5
 DIST bash52-025.sig 95 BLAKE2B aff63f1a0a753b632f0d2ce4cf8f4117689469150d41dd0e0d7f76fca973d52fb16f3957b12709826e50705f921fe141108b1046de05d17b40216ed5d4a00893 SHA512 079888adce1cb8583b547d67005f179614f1c42756de20acdb9e24763dec145a421c68e7ceb48d42b853ae7fcb07e051cc1ca56f9dfd337c9a1b001618df2828
 DIST bash52-026 1372 BLAKE2B ebe3bc47dadf5d689258c5ccf9883838d3383dc43bec68d2a6767b6348cf1515a98ec9e445c3110e8eb0d87e742c20a0d4ddb70649ec94217f55aad7d18552af SHA512 571993da2b8067ef5b7b705aee65dd414ee70b216ffbcb9fab7c08807b87a72465594c3f1576c795ae86bf951911cdde70ad1037e851b88ee379c4237ccff6fe
 DIST bash52-026.sig 95 BLAKE2B 175df0703ee5374094d41761ebc2827d34cb97328ea8e486cc9e5c946e482a7d0a16a7ac45e11296500cff8ac4c013e60b07d34abf8b3478527a80f742fbe85e SHA512 6db725ffcf429e04551b2fde329067696b20bef9418b57cff56a62f31c262d0b800061284469eb9f809ca49516516735213dc05defab52ff864ac3b214336559
+DIST bash52-027 1881 BLAKE2B b76ce03456e064f17db00e9026aa53656a063c195faa02c7d51da8d173f7525fe5411bf526f19ee9e717ee1ec957de7e73f5af851a68d5cb554f2c4492ab3844 SHA512 644ef1ea0ce002913b443cfc74d1376b3b8d1c7c976c88cfcec663313563ea905af3aa7ab7236e0ee8336195b01cfc7f2a5a738c5f787a637be92cda937f571e
+DIST bash52-027.sig 95 BLAKE2B 7120dc764120e108fbafd80dcd5010aea2f79f7508fda375740f7601c5e7508f2c830673101fe528a79cb4a7a5718ebd5dcf5e7ae81943008b128b10bb57ab8b SHA512 ad76bc672e53c62a8554a2889d420294f7dde0a996cb3058ca8a3a4108b53d35ed56dbcd0601f1984b3ae26dfe5eb6d99c9d46ebe78f0947b82502bef2419152
+DIST bash52-028 1571 BLAKE2B 58fdeecf6dd685103c7dc0e7c200cae65206e5fb3360d798b9cec05fc935ebae139bdf142f6018c9837d1780eb7c5cecff0a945369c14fa575e6801c46a15a31 SHA512 0e59ee230c2f9394814578e56270efa93e5ed8ed2fbf0c0777fdfad4d3f01f560923a80792998789c901068d88371f984f539fdebbec726759eeb7966d324328
+DIST bash52-028.sig 95 BLAKE2B 62d4663cfb25b470635321815e0860434c2edb35b220450d0123fc0bee2d80f29af060c34c765a48d75b49030f17d50852a1540be28fc615ebdd3f32391fe4d1 SHA512 e3e37ac8e6a29688c4c9dd318fc767331eec39bf947670060ebd42fd8262aad400152dc02d1d459f00170e6b788cf95d4a0a6dd62a2eae4af5bc67ebc80ece5d
+DIST bash52-029 3619 BLAKE2B 01ddb0acc5b6067e729320692284d61735ace62eeede81a74b7628fe6899da61d921a11bd0d22d0e6f2e241e7b0cb64591654a34a33916739e35e23d5cc6f5bd SHA512 b0b134347fbe0916b9c0fc60a9dbc6b6ebc7439bd5a12d0cda29a0012cbbcc16414392597764c24b8ca716ce727bce7da7fae39acc3cdba9506efb01014a43ae
+DIST bash52-029.sig 95 BLAKE2B 49c408e8da095c130868b3fab7afb85408307a10d9154dda818e014cec2ec973e1fc2a96dcd7a1769d1581e3c1d758d172bfa066d7b1ea6fdbb80e062d24ef64 SHA512 11aeca6b46a5cdf518b26a59a972e956455cb4d15aedd968ad36f8100bfc38448f89fe7a72dbecfa8da9fe556a194dda9bb34f1d16c2408b92b0e594f163f262
+DIST bash52-030 4111 BLAKE2B d0cf114642393eb2e2d060eac339674c8ce10af4d54bbcee0f450854d27373ede9dd159caf6d05fc69429ad357d666b47f6781ef590287f33a535b2c26d8754d SHA512 515902fd567dfbbca3d4f6d98a7f2f5a9d1ad323d829f9b90839de4807592708dea3d52f67cb868617278f9c8c6bb299ab3310d898be344d63e824043f17fe2d
+DIST bash52-030.sig 95 BLAKE2B b8edc295a6646721ce7be79ebac2331a36c0b84ca9f5a6b6e8c2da0674f1279debaf941bbbddd56e2b868afc60a92a34fd312e049fc8524ba1e88ca5cb952acc SHA512 2592d5b7f62a23dd16153691053e462342ae33f347349348de98487c52d2e73ab0d46216505925bc887bceb069bcb5c1c5ce7ce803e62eec7ef0458dbaf1fb69
+DIST bash52-031 1159 BLAKE2B dac378115906e21fc754267c42e129e2374c9b63f879d1717d79930589618d4d8d17821b2f529d1851db7567d3efdfb0410c18e6869047e3d87443b29d507289 SHA512 08f3e3cb6a6554ea6d1b1f5cbcd156cb75f9c0c5350801b67352a1c2ffec0d02d90c0947736fd52de304e549a1b919ea0ff42e23a8cf63a721a351ea1732bea5
+DIST bash52-031.sig 95 BLAKE2B 50e5c0b3afb0ffc8b1863bde645316d7c7c49e8b396041ca1dcf269c50b532aaccf0c3fb5a5e64036ece9054d8ccf78f7e829ecf0fbdcf8531ba57230b129f1c SHA512 f656d8fbbe79450fbf193e5c2aebc85cfc425703495f2925aa774d5c0e742ebf523c191264673c6dd76fa6071c39d5155698687475eb634cd6553e86266f91a5
+DIST bash52-032 1529 BLAKE2B 55aab849da0fcc69ab3516d9d7ff2858b5f15cbeaddf66282f43f272b52d646c2c41c2ceef632a2ae8f13c25d92e85f49fbc6de989ed4f6ac4bb7bea7fc59a5d SHA512 9eb277d2d92b9ec49f70582e52305bc45b425b189ba2a15c51c537e07ccf9cb894c1ca44fa399b04297fe51027aff7f169f41efe2d60895ca55c421c0778ef32
+DIST bash52-032.sig 95 BLAKE2B 23a5cd003c957932d0c0192b63a5e8e7366bf939c3f54ff91b444e3729607c88677fdf4a5b435e47da4a64624b10d8696e4e950fac8fbb6932bb4c64506d1f9f SHA512 d3b08c3d0efee81a8507b530405a886259438bfc4c2ab984dbe80d30177775aacf6448a2673f0bd274fe46c938a8b8d46844d3794374bafce63f7c1d8bf4efe1
diff --git a/app-shells/bash/bash-5.2_p32.ebuild b/app-shells/bash/bash-5.2_p32.ebuild
new file mode 100644
index 000000000000..c279cf9bca3d
--- /dev/null
+++ b/app-shells/bash/bash-5.2_p32.ebuild
@@ -0,0 +1,402 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
+inherit flag-o-matic toolchain-funcs prefix verify-sig
+
+# Uncomment if we have a patchset.
+#GENTOO_PATCH_DEV="sam"
+#GENTOO_PATCH_VER="${PV}"
+
+MY_PV=${PV/_p*}
+MY_PV=${MY_PV/_/-}
+MY_P=${PN}-${MY_PV}
+MY_PATCHES=()
+
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
+case ${PV} in
+	*_p*)
+		PLEVEL=${PV##*_p}
+		;;
+	9999|*_alpha*|*_beta*|*_rc*)
+		# Set a negative patchlevel to indicate that it's a pre-release.
+		PLEVEL=-1
+		;;
+	*)
+		PLEVEL=0
+esac
+
+# The version of readline this bash normally ships with. Note that we only use
+# the bundled copy of readline for pre-releases.
+READLINE_VER="8.2_p1"
+
+DESCRIPTION="The standard GNU Bourne again shell"
+HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
+	EGIT_BRANCH=devel
+	inherit git-r3
+else
+	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
+
+	# bash-5.1 -> bash51
+	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
+
+	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
+		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
+		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
+		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
+	done
+
+	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
+
+	unset -v my_urls my_p my_patch_idx my_patch_ver
+fi
+
+if [[ ${GENTOO_PATCH_VER} ]]; then
+	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
+fi
+
+S=${WORKDIR}/${MY_P}
+
+LICENSE="GPL-3+"
+SLOT="0"
+if (( PLEVEL >= 0 )); then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
+
+DEPEND="
+	>=sys-libs/ncurses-5.2-r2:=
+	nls? ( virtual/libintl )
+"
+if (( PLEVEL >= 0 )); then
+	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
+fi
+RDEPEND="
+	${DEPEND}
+"
+# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
+BDEPEND="
+	pgo? ( dev-util/gperf )
+	verify-sig? ( sec-keys/openpgp-keys-chetramey )
+"
+
+# EAPI 8 tries to append it but it doesn't exist here.
+QA_CONFIGURE_OPTIONS="--disable-static"
+
+PATCHES=(
+	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
+
+	# Patches to or from Chet, posted to the bug-bash mailing list.
+	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
+	"${FILESDIR}/${PN}-5.2_p15-random-ub.patch"
+	"${FILESDIR}/${PN}-5.2_p15-configure-clang16.patch"
+	"${FILESDIR}/${PN}-5.2_p21-wpointer-to-int.patch"
+	"${FILESDIR}/${PN}-5.2_p21-configure-strtold.patch"
+	"${FILESDIR}/${PN}-5.2_p32-memory-leaks.patch"
+)
+
+pkg_setup() {
+	# bug #7332
+	if is-flag -malign-double; then
+		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
+		eerror "as it breaks LFS (struct stat64) on x86."
+		die "remove -malign-double from your CFLAGS mr ricer"
+	fi
+
+	if use bashlogger; then
+		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
+		ewarn "This will log ALL output you enter into the shell, you have been warned."
+	fi
+}
+
+src_unpack() {
+	local patch
+
+	if [[ ${PV} == 9999 ]]; then
+		git-r3_src_unpack
+	else
+		if use verify-sig; then
+			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
+
+			for patch in "${MY_PATCHES[@]}"; do
+				verify-sig_verify_detached "${patch}"{,.sig}
+			done
+		fi
+
+		unpack "${MY_P}.tar.gz"
+
+		if [[ ${GENTOO_PATCH_VER} ]]; then
+			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Include official patches.
+	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
+
+	# Clean out local libs so we know we use system ones w/releases. The
+	# touch utility is invoked for the benefit of config.status.
+	if (( PLEVEL >= 0 )); then
+		rm -rf lib/{readline,termcap}/* \
+		&& touch lib/{readline,termcap}/Makefile.in \
+		&& sed -i -E 's:\$[{(](RL|HIST)_LIBSRC[)}]/[[:alpha:]_-]*\.h::g' Makefile.in \
+		|| die
+	fi
+
+	# Prefixify hardcoded path names. No-op for non-prefix.
+	hprefixify pathnames.h.in
+
+	# Avoid regenerating docs after patches, bug #407985.
+	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
+	&& touch -r . doc/* \
+	|| die
+
+	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
+	rm tests/run-jobs || die
+
+	eapply -p0 "${PATCHES[@]}"
+	eapply_user
+}
+
+src_configure() {
+	local -a myconf
+
+	# Upstream only test with Bison and require GNUisms like YYEOF and
+	# YYERRCODE. The former at least may be in POSIX soon:
+	# https://www.austingroupbugs.net/view.php?id=1269.
+	# configure warns on use of non-Bison but doesn't abort. The result
+	# may misbehave at runtime.
+	unset -v YACC
+
+	myconf=(
+		--disable-profiling
+
+		# Force linking with system curses ... the bundled termcap lib
+		# sucks bad compared to ncurses.  For the most part, ncurses
+		# is here because readline needs it.  But bash itself calls
+		# ncurses in one or two small places :(.
+		--with-curses
+
+		$(use_enable mem-scramble)
+		$(use_enable net net-redirections)
+		$(use_enable readline)
+		$(use_enable readline bang-history)
+		$(use_enable readline history)
+		$(use_with afs)
+		$(use_with mem-scramble bash-malloc)
+	)
+
+	# For descriptions of these, see config-top.h.
+	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
+	append-cppflags \
+		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
+		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
+		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
+		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
+		-DNON_INTERACTIVE_LOGIN_SHELLS \
+		-DSSH_SOURCE_BASHRC \
+		$(use bashlogger && echo -DSYSLOG_HISTORY)
+
+	use nls || myconf+=( --disable-nls )
+
+	if (( PLEVEL >= 0 )); then
+		# Historically, we always used the builtin readline, but since
+		# our handling of SONAME upgrades has gotten much more stable
+		# in the PM (and the readline ebuild itself preserves the old
+		# libs during upgrades), linking against the system copy should
+		# be safe.
+		# Exact cached version here doesn't really matter as long as it
+		# is at least what's in the DEPEND up above.
+		export ac_cv_rl_version=${READLINE_VER%%_*}
+
+		# Use system readline only with released versions.
+		myconf+=( --with-installed-readline=. )
+	fi
+
+	if use plugins; then
+		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
+	else
+		# Disable the plugins logic by hand since bash doesn't provide
+		# a way of doing it.
+		export ac_cv_func_dl{close,open,sym}=no \
+			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
+
+		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
+	fi
+
+	# bug #444070
+	tc-export AR
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	local -a pgo_generate_flags pgo_use_flags
+	local flag
+
+	# -fprofile-partial-training because upstream notes the test suite isn't
+	# super comprehensive.
+	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	if use pgo; then
+		pgo_generate_flags=(
+			-fprofile-update=atomic
+			-fprofile-dir="${T}"/pgo
+			-fprofile-generate="${T}"/pgo
+		)
+		pgo_use_flags=(
+			-fprofile-use="${T}"/pgo
+			-fprofile-dir="${T}"/pgo
+		)
+		if flag=$(test-flags-CC -fprofile-partial-training); then
+			pgo_generate_flags+=( "${flag}" )
+			pgo_use_flags+=( "${flag}" )
+		fi
+	fi
+
+	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
+	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
+
+	# Build Bash and run its tests to generate profiles.
+	if (( ${#pgo_generate_flags[@]} )); then
+		# Used in test suite.
+		unset -v A
+
+		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
+
+		if tc-is-clang; then
+			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
+		fi
+
+		# Rebuild Bash using the profiling data we just generated.
+		emake clean
+		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
+		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
+	fi
+}
+
+src_test() {
+	# Used in test suite.
+	unset -v A
+
+	default
+}
+
+src_install() {
+	local d f
+
+	default
+
+	my_prefixify() {
+		while read -r; do
+			if [[ $REPLY == *$1* ]]; then
+				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
+			fi
+			printf '%s\n' "${REPLY}" || ! break
+		done < "$2" || die
+	}
+
+	dodir /bin
+	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
+	dosym bash /bin/rbash
+
+	insinto /etc/bash
+	doins "${FILESDIR}"/bash_logout
+	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
+
+	insinto /etc/bash/bashrc.d
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color.bash | newins - 10-gentoo-color.bash
+	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r1.bash 10-gentoo-title.bash
+	if [[ ! ${EPREFIX} ]]; then
+		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
+	fi
+
+	insinto /etc/skel
+	for f in bash{_logout,_profile,rc}; do
+		newins "${FILESDIR}/dot-${f}" ".${f}"
+	done
+
+	if use plugins; then
+		exeinto "/usr/$(get_libdir)/bash"
+		set -- examples/loadables/*.o
+		doexe "${@%.o}"
+
+		insinto /usr/include/bash-plugins
+		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
+	fi
+
+	if use examples; then
+		for d in examples/{functions,misc,scripts,startup-files}; do
+			exeinto "/usr/share/doc/${PF}/${d}"
+			docinto "${d}"
+			for f in "${d}"/*; do
+				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
+					doexe "${f}"
+				else
+					dodoc "${f}"
+				fi
+			done
+		done
+	fi
+
+	# Install bash_builtins.1 and rbash.1.
+	emake -C doc DESTDIR="${D}" install_builtins
+	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
+	doman "${T}"/rbash.1
+
+	newdoc CWRU/changelog ChangeLog
+	dosym bash.info /usr/share/info/bashref.info
+}
+
+pkg_preinst() {
+	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
+		mkdir -p -- "${EROOT}"/etc/bash \
+		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
+		|| die
+	fi
+}
+
+pkg_postinst() {
+	local old_ver
+
+	# If /bin/sh does not exist, provide it.
+	if [[ ! -e ${EROOT}/bin/sh ]]; then
+		ln -sf -- bash "${EROOT}"/bin/sh || die
+	fi
+
+	read -r old_ver <<<"${REPLACING_VERSIONS}"
+	if [[ ! $old_ver ]]; then
+		:
+	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
+		return
+	fi
+
+	while read -r; do ewarn "${REPLY}"; done <<'EOF'
+Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
+
+Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
+characteristics of the operating environment, it may contain a command to set
+the terminal's window title. Those who were already choosing to customise the
+PROMPT_COMMAND variable are now advised to append their commands like so:
+
+PROMPT_COMMAND+=('custom command goes here')
+
+Gentoo no longer defaults to having bash set the window title in the case
+that the terminal is controlled by sshd(8), unless screen is launched on the
+remote side or the terminal reliably supports saving and restoring the title
+(as alacritty, foot and tmux do). Those wanting for the title to be set
+regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
+drop-in - to set PROMPT_COMMMAND like so:
+
+PROMPT_COMMAND=(genfun_set_win_title)
+
+Those who would prefer for bash never to interfere with the window title may
+now opt out of the default title setting behaviour, either with the "unset -v
+PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
+EOF
+}
diff --git a/app-shells/bash/files/bash-5.2_p32-memory-leaks.patch b/app-shells/bash/files/bash-5.2_p32-memory-leaks.patch
new file mode 100644
index 000000000000..0c60e70d3cb5
--- /dev/null
+++ b/app-shells/bash/files/bash-5.2_p32-memory-leaks.patch
@@ -0,0 +1,130 @@
+[Compared to bash-5.2_p26-memory-leaks.patch, this drops a hunk for
+builtins/evalstring.c as the open_redir_file issue is fixed in patch 31
+upstream for bash-5.2]
+
+https://lists.gnu.org/archive/html/bug-bash/2024-01/msg00036.html
+https://lists.gnu.org/archive/html/bug-bash/2024-01/txtm8yNNPR9RQ.txt
+
+For evalstring.c:
+* https://lists.gnu.org/archive/html/bug-bash/2024-01/msg00011.html
+* https://git.savannah.gnu.org/cgit/bash.git/diff/builtins/evalstring.c?h=devel&id=81f7b44564cd1510788035cea7c59631865a7db2&dt=1#n766
+
+From 711ab85262884f2b91f09eceb9aefd0e2426ce67 Mon Sep 17 00:00:00 2001
+From: Grisha Levit <grishalevit@gmail.com>
+Date: Sat, 3 Jun 2023 16:51:26 -0400
+Subject: [PATCH] various leaks
+
+Found mostly by normal usage running a no-bash-malloc build with clang's
+LeakSanitizer enabled. So far seems to provide very accurate results.
+
+* arrayfunc.c
+- quote_compound_array_word: make sure to free VALUE
+- bind_assoc_var_internal: if assigning to a dynamic variable, make sure
+  to free the key (usually assoc_insert would do it)
+
+* bashline.c
+- bash_command_name_stat_hook: free original *NAME if we are going to
+  change what it points to (what the callers seem to expect)
+
+* builtins/evalstring.c
+- parse_and_execute: make sure to dispose of the parsed command
+  resulting from a failed function import attempt
+
+* examples/loadables/stat.c
+- loadstat: bind_assoc_variable does not free its VALUE argument so make
+  sure to do it
+
+* subst.c
+- param_expand: free temp1 value for codepaths that don't do it
+---
+ arrayfunc.c               | 6 +++++-
+ bashline.c                | 1 +
+ builtins/evalstring.c     | 4 ++++
+ examples/loadables/stat.c | 1 +
+ subst.c                   | 2 ++
+ 5 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/arrayfunc.c b/arrayfunc.c
+index 2c05d15b..8ba64084 100644
+--- arrayfunc.c
++++ arrayfunc.c
+@@ -208,7 +208,10 @@ bind_assoc_var_internal (entry, hash, key, value, flags)
+   newval = make_array_variable_value (entry, 0, key, value, flags);
+ 
+   if (entry->assign_func)
+-    (*entry->assign_func) (entry, newval, 0, key);
++    {
++      (*entry->assign_func) (entry, newval, 0, key);
++      FREE (key);
++    }
+   else
+     assoc_insert (hash, key, newval);
+ 
+@@ -985,6 +988,7 @@ quote_compound_array_word (w, type)
+   if (t != w+ind)
+    free (t);
+   strcpy (nword + i, value);
++  free (value);
+ 
+   return nword;
+ }
+diff --git a/bashline.c b/bashline.c
+index c85b05b6..bd7548cc 100644
+--- bashline.c
++++ bashline.c
+@@ -1928,6 +1928,7 @@ bash_command_name_stat_hook (name)
+   result = search_for_command (cname, 0);
+   if (result)
+     {
++      FREE (*name);
+       *name = result;
+       return 1;
+     }
+diff --git a/builtins/evalstring.c b/builtins/evalstring.c
+index df3dd68e..20c6a4a7 100644
+--- builtins/evalstring.c
++++ builtins/evalstring.c
+@@ -461,6 +461,8 @@ parse_and_execute (string, from_file, flags)
+ 		      should_jump_to_top_level = 0;
+ 		      last_result = last_command_exit_value = EX_BADUSAGE;
+ 		      set_pipestatus_from_exit (last_command_exit_value);
++		      dispose_command(command);
++		      global_command = (COMMAND *)NULL;
+ 		      reset_parser ();
+ 		      break;
+ 		    }
+ 
+diff --git a/examples/loadables/stat.c b/examples/loadables/stat.c
+index 1e60e7b6..ed5c9764 100644
+--- examples/loadables/stat.c
++++ examples/loadables/stat.c
+@@ -349,6 +349,7 @@ loadstat (vname, var, fname, flags, fmt, sp)
+       key = savestring (arraysubs[i]);
+       value = statval (i, fname, flags, fmt, sp);
+       v = bind_assoc_variable (var, vname, key, value, ASS_FORCE);
++      free (value);
+     }
+   return 0;
+ }
+diff --git a/subst.c b/subst.c
+index 1ac6eb2d..ff0602da 100644
+--- subst.c
++++ subst.c
+@@ -10727,6 +10727,7 @@ comsub:
+ 	    {
+ 	      chk_atstar (temp, quoted, pflags, quoted_dollar_at_p, contains_dollar_at);
+ 	      tdesc = parameter_brace_expand_word (temp, SPECIAL_VAR (temp, 0), quoted, pflags, 0);
++	      free (temp1);
+ 	      if (tdesc == &expand_wdesc_error || tdesc == &expand_wdesc_fatal)
+ 		return (tdesc);
+ 	      ret = tdesc;
+@@ -10739,6 +10740,7 @@ comsub:
+ 	    {
+ 	      set_exit_status (EXECUTION_FAILURE);
+ 	      report_error (_("%s: invalid variable name for name reference"), temp);
++	      free (temp1);
+ 	      return (&expand_wdesc_error);	/* XXX */
+ 	    }
+ 	  else
+-- 
+2.43.0