Path: csiph.com!xmission!news.snarked.org!news.linkpendium.com!news.linkpendium.com!panix!usenet.stanford.edu!not-for-mail
From: Eduardo =?iso-8859-1?Q?A=2E_Bustamante_L=F3pez?= <dualbus@gmail.com>
Newsgroups: gnu.bash.bug
Subject: Re: Segmentation fault in pat_subst
Date: Tue, 23 Jul 2019 22:32:34 -0700
Lines: 20
Approved: bug-bash@gnu.org
Message-ID: <mailman.2126.1563946360.2688.bug-bash@gnu.org>
References: <20190720222300.GA13083@system76-pc.vc.shawcable.net> <f28d89b4-035f-134c-8184-fe5f019d7246@case.edu> <20190724053234.GA14361@system76-pc.vc.shawcable.net>
NNTP-Posting-Host: lists.gnu.org
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Cc: bug-bash@gnu.org
To: Chet Ramey <chet.ramey@case.edu>
Envelope-to: bug-bash@gnu.org
Mail-Followup-To: Chet Ramey <chet.ramey@case.edu>, bug-bash@gnu.org
Content-Disposition: inline
In-Reply-To: <f28d89b4-035f-134c-8184-fe5f019d7246@case.edu>
User-Agent: Mutt/1.10.1 (2018-07-13)
Precedence: list
Xref: csiph.com gnu.bash.bug:15222

On Sun, Jul 21, 2019 at 06:56:09PM -0400, Chet Ramey wrote:
(...)
> Thanks for the report. Look at match_wpattern and consider what happens if
> wmatchlen returns something longer than the string length. It will be fixed
> for the next devel branch push.

Aha! I see.

| Starting program: /tmp/bash/bash -c x=0\;\ :\ \$\{x/\#\[0�\\Z\[:\]\]\}
| 
| Breakpoint 1, match_wpattern (wstring=0x5555556c1d90 L"0", indices=0x5555556c1e20, wstrlen=1, wpat=0x5555556c1d00 L"[0�\\Z[:]]", mtype=1, sp=0x7fffffffd918, ep=0x7fffffffd910)
|     at /home/dualbus/src/gnu/bash/subst.c:4963
| 4963      if (mlen > wstrlen)
| (gdb) p mlen
| $1 = 2
| (gdb) p wstrlen
| $2 = 1

Interesting, I can see how that `mlen = 2' can cause trouble. Thank you for the pointer and the fix!