Some segfaults possible via mapfile callbacks

[Dan Douglas]

Hi. These were easy for me to reproduce in various versions.

Export to mapfile the variable to be assigned, then run any callback:
        $ printf '%s\n' {a..z} | bash -xc 'a= mapfile -tc1 -C : a'
        + a=
        + mapfile -tc1 -C : a
        ++ : 0 a
        Segmentation fault

Set any variable, then unset mapfile's variable. (takes a few iterations):
        $ printf '%s\n' {a..z} | bash -xc 'b=; mapfile -tc1 -C "unset -v a; :" 
a'
        + b=
        + mapfile -tc1 -C 'unset -v a; :' a
        ++ unset -v a
        ++ : 0 a
        ++ unset -v a
        ++ : 1 b
        ++ unset -v a
        ++ : 2 c
        Segmentation fault

Or modify its type to anything but an indexed array for a faster failure:
        $ printf '%s\n' {a..z} | bash -xc 'b=; mapfile -tc1 -C "unset -v a; a=; 
:" a'
        + b=
        + mapfile -tc1 -C 'unset -v a; a=; :' a
        ++ unset -v a
        ++ a=
        ++ : 0 a
        Segmentation fault

Or indirectly via nameref:
        $ printf '%s\n' {a..z} | bash -xc 'typeset -n x=a; mapfile -tc1 -C 
"unset -v x; :" a'
        + typeset -n x=a
        + mapfile -tc1 -C 'unset -v x; :' a
        ++ unset -v x
        ++ : 0 a
        Segmentation fault

There were others, mostly to do with modifying the variable being mapped.
-- 
Dan Douglas

signature.asc
Description: This is a digitally signed message part.