Path: csiph.com!xmission!news.glorb.com!usenet.stanford.edu!not-for-mail From: Chet Ramey Newsgroups: gnu.bash.bug Subject: Re: 4-byte script triggers null ptr deref and segfault Date: Thu, 17 Sep 2015 21:57:05 -0400 Organization: ITS, Case Western Reserve University Lines: 17 Approved: bug-bash@gnu.org Message-ID: References: Reply-To: chet.ramey@case.edu NNTP-Posting-Host: lists.gnu.org Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Trace: usenet.stanford.edu 1442541444 17772 208.118.235.17 (18 Sep 2015 01:57:24 GMT) X-Complaints-To: action@cs.stanford.edu Cc: chet.ramey@case.edu To: Brian Carpenter , bug-bash@gnu.org Envelope-to: bug-bash@gnu.org User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 In-Reply-To: X-Junkmail-Whitelist: YES (by domain whitelist at mpv2.tis.cwru.edu) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.4.x-2.6.x [generic] X-Received-From: 129.22.105.37 X-BeenThere: bug-bash@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Bug reports for the GNU Bourne Again SHell List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Xref: csiph.com gnu.bash.bug:11500 On 9/17/15 12:50 PM, Brian Carpenter wrote: > While fuzzing GNU bash version 4.3.42(1)-release > (x86_64-unknown-linux-gnu) with AFL(http://lcamtuf.coredump.cx/afl), I > stumbled upon a 4-byte 'script' that triggers a null ptr deref and causes a > segfault. > > https://savannah.gnu.org/support/index.php?108885 Thanks for the report. This was fixed late last October, and the fix is in the devel branch and bash-4.4-alpha. Chet -- ``The lyf so short, the craft so long to lerne.'' - Chaucer ``Ars longa, vita brevis'' - Hippocrates Chet Ramey, ITS, CWRU chet@case.edu http://cnswww.cns.cwru.edu/~chet/