Re: bash -n: stack overflow in extract_delimited_string()

From	Jakub Wilk <jwilk@jwilk.net>
Newsgroups	gnu.bash.bug
Subject	Re: bash -n: stack overflow in extract_delimited_string()
Date	2020-08-03 19:35 +0200
Message-ID	<mailman.682.1596476169.2739.bug-bash@gnu.org> (permalink)
References	<20200803093054.gu6fmxi4eqi7hz45@jwilk.net> <7177240a-2e57-49c2-e35a-7bb16bfc12e3@case.edu> <20200803173559.nwrhjxgbnv2hnj2a@jwilk.net>

Show all headers | View raw

* Chet Ramey <chet.ramey@case.edu>, 2020-08-03, 09:15:
>On 8/3/20 5:30 AM, Jakub Wilk wrote:
>
>> Bash Version: 5.0
>> Patch Level: 18
>> Release Status: release
>>
>> bash crashes with stack overflow when checking syntax of this crafted script:
>>
>>   $ ulimit -s
>>   8192
>>
>>   $ printf 'x[$(($(fi)))`\n%050000d\n][`]\n' | tr 0 '(' | bash -n
>>   bash: command substitution: line 4: syntax error near unexpected token `fi'
>>   bash: command substitution: line 4: `fi)))`'
>>   Segmentation fault
>
>I can't reproduce this with bash-5.1-alpha.

Oh right, looks like this was fixed in the 20191108 snapshot, probably 
by this change:

parse.y
	- xparse_dolparen: if the command substitution is incomplete or doesn't
	  end in `)', print an error message instead of allowing EOS to
	  terminate the comsub. From a bug report from
	  Oguz <oguzismailuysal@gmail.com>

-- 
Jakub Wilk

Back to gnu.bash.bug | Previous | Next | Find similar

Thread

Re: bash -n: stack overflow in extract_delimited_string() Jakub Wilk <jwilk@jwilk.net> - 2020-08-03 19:35 +0200

csiph-web