Bug#832896: /usr/bin/checkbashisms: checkbashisms fails to detect substring expansion with negative offsets

[Antonio Ospite]

Package: devscripts
Version: 2.16.6
Severity: normal
File: /usr/bin/checkbashisms

Dear Maintainer,

checkbashisms does not detect substring expansion when negative values
are used for offset or length.

------------------------------------------------------------------------------
#!/bin/sh

STR="0123456789"

# This substring expansion will be detected
#echo "${STR:1:10}"

# These ones won't
echo "${STR: -10:1}"
echo "${STR:0: -9}"
------------------------------------------------------------------------------

This may be due to the fact that the negative values must be preceded by
a white space, as the bash manual says, but I haven't looked at the
checkbashisms code, this is just an hypothesis.

Thanks,
   Antonio


-- Package-specific info:

--- /etc/devscripts.conf ---

--- ~/.devscripts ---
BTS_SMTP_HOST=out.alice.it
BTS_CACHE=no
AUTO_LINTIAN=${AUTO_LINTIAN:-yes}
DEBCHANGE_RELEASE_HEURISTIC=changelog

-- System Information:
Debian Release: stretch/sid
  APT prefers unstable
  APT policy: (900, 'unstable'), (500, 'unstable-debug')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.6.0-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=it_IT.utf8, LC_CTYPE=it_IT.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Init: systemd (via /run/systemd/system)

Versions of packages devscripts depends on:
ii  dpkg-dev     1.18.9
ii  libc6        2.23-4
ii  perl         5.22.2-3
pn  python3:any  <none>

Versions of packages devscripts recommends:
ii  apt                         1.3~pre2
ii  at                          3.1.20-1
ii  curl                        7.47.0-1
ii  dctrl-tools                 2.24-2
ii  debian-keyring              2016.07.02
ii  dput                        0.9.6.4
ii  dupload                     2.7.0
ii  equivs                      2.0.9+nmu1
ii  fakeroot                    1.21-1
ii  file                        1:5.28-4
ii  gnupg                       1.4.20-6
ii  gnupg2                      2.1.11-7
ii  libdistro-info-perl         0.14
ii  libencode-locale-perl       1.05-1
ii  liblwp-protocol-https-perl  6.06-2
ii  libsoap-lite-perl           1.20-1
ii  liburi-perl                 1.71-1
ii  libwww-perl                 6.15-1
ii  licensecheck                3.0.13-1
ii  lintian                     2.5.45
ii  man-db                      2.7.5-1
ii  patch                       2.7.5-1
ii  patchutils                  0.3.4-1
ii  python3-debian              0.1.28
ii  python3-magic               1:5.28-4
ii  sensible-utils              0.0.9
ii  strace                      4.12-3
ii  unzip                       6.0-20
ii  wdiff                       1.2.2-1+b1
ii  wget                        1.18-2
ii  xz-utils                    5.1.1alpha+20120614-2.1

Versions of packages devscripts suggests:
ii  bsd-mailx [mailx]            8.1.2-0.20160123cvs-3
ii  build-essential              12.2
pn  cvs-buildpackage             <none>
pn  devscripts-el                <none>
pn  diffoscope                   <none>
pn  dose-extra                   <none>
ii  gnuplot                      5.0.3+dfsg3-7
ii  gpgv                         1.4.20-6
ii  libauthen-sasl-perl          2.1600-1
ii  libfile-desktopentry-perl    0.22-1
ii  libnet-smtp-ssl-perl         1.03-1
pn  libterm-size-perl            <none>
ii  libtimedate-perl             2.3000-2
pn  libyaml-syck-perl            <none>
ii  mozilla-devscripts           0.47
ii  mutt                         1.6.0-1
ii  openssh-client [ssh-client]  1:7.2p2-7
pn  svn-buildpackage             <none>
ii  w3m                          0.5.3-29

-- no debconf information
-- 
Antonio Ospite
http://ao2.it

A: Because it messes up the order in which people normally read text.
   See http://en.wikipedia.org/wiki/Posting_style
Q: Why is top-posting such a bad thing?