The special-case handling of namerefs as for loop control variables is missing checks for the readonly attribute on the nameref and allows creation of forbidden nameref self-references.
$ declare -rn ref=a $ for ref in b; { :; } $ declare -p ref declare -nr ref="b" $ declare -n ref $ for ref in ref; { declare -p ref; } declare -n ref="ref" --- execute_cmd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/execute_cmd.c b/execute_cmd.c index feccf7c7..71bbfb4e 100644 --- a/execute_cmd.c +++ b/execute_cmd.c @@ -2800,8 +2800,10 @@ execute_for_command (for_command) sh_invalidid (list->word->word); v = 0; } + else if (readonly_p (v)) + err_readonly (name_cell (v)); else - v = bind_variable_value (v, list->word->word, 0); + v = bind_variable_value (v, list->word->word, ASS_NAMEREF); } else v = bind_variable (identifier, list->word->word, 0); --