Path: csiph.com!optima2.xanadu-bbs.net!xanadu-bbs.net!news.glorb.com!usenet.stanford.edu!not-for-mail
From: Chet Ramey <chet.ramey@case.edu>
Newsgroups: gnu.bash.bug
Subject: Re: null ptr deref / segfault in bash 4.4.0(1)-beta
Date: Sat, 19 Sep 2015 17:54:01 -0400
Organization: ITS, Case Western Reserve University
Lines: 21
Approved: bug-bash@gnu.org
Message-ID: <mailman.1416.1442699650.19560.bug-bash@gnu.org>
References: <CANMVOuyewnwZj8gqjZYgE5b_rCDGLnMKxuAgYrWF2MO4-3+enQ@mail.gmail.com>
Reply-To: chet.ramey@case.edu
NNTP-Posting-Host: lists.gnu.org
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-Trace: usenet.stanford.edu 1442699650 5634 208.118.235.17 (19 Sep 2015 21:54:10 GMT)
X-Complaints-To: action@cs.stanford.edu
Cc: chet.ramey@case.edu
To: Brian Carpenter <brian.carpenter@gmail.com>, bug-bash@gnu.org
Envelope-to: bug-bash@gnu.org
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0) Gecko/20100101 Thunderbird/38.2.0
In-Reply-To: <CANMVOuyewnwZj8gqjZYgE5b_rCDGLnMKxuAgYrWF2MO4-3+enQ@mail.gmail.com>
X-Junkmail-Whitelist: YES (by domain whitelist at mpv1.tis.cwru.edu)
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.4.x-2.6.x [generic]
X-Received-From: 129.22.105.36
X-BeenThere: bug-bash@gnu.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: Bug reports for the GNU Bourne Again SHell <bug-bash.gnu.org>
List-Unsubscribe: <https://lists.gnu.org/mailman/options/bug-bash>, <mailto:bug-bash-request@gnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/archive/html/bug-bash>
List-Post: <mailto:bug-bash@gnu.org>
List-Help: <mailto:bug-bash-request@gnu.org?subject=help>
List-Subscribe: <https://lists.gnu.org/mailman/listinfo/bug-bash>, <mailto:bug-bash-request@gnu.org?subject=subscribe>
Xref: csiph.com gnu.bash.bug:11510

On 9/18/15 8:06 PM, Brian Carpenter wrote:
> While fuzzing bash 4.4.0(1)-beta compiled from the devel branch, I came
> across another script which triggers a null ptr dereference and a segfault.
> This script seems to crash these other versions of bash as well:
> 
> 4.2.37(1)-release on x86_64 Debian, 4.3.39(1)-release on x86_64 Red Hat
> 
> hexdump -v -C test00
> 00000000  5f 3d 28 7b 24 5b 3c 28  30 26 5f 3d 28 5d 29 0a  |_=({$[<(0&_=(]).|
> 00000010  30 29                                             |0)|
> 00000012

Thanks for the report.  This will be fixed in the next release of bash.

Chet

-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
		 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, ITS, CWRU    chet@case.edu    http://cnswww.cns.cwru.edu/~chet/