The parser goes into an infinite loop with the following input: dualbus@debian:~/bash-fuzzing/bash-parser$ cat -v output/13/crashes/id:000042,sig:11,src:005617,op:havoc,rep:4 for ((0funcM-^Nion;)); do :M->M-aM-RM->M->e& d^?^@e :; done&M-wd\\\cr$\osM-ac\\M-ac\\^\\M-]\^\\M-]\\\cr\^\\M-]\\\c'M-^?^ZM-a^@^P\^M-\SM-]\\\\\^O\H\\\\M-EsM-ac\\M-ac\\^\\M-]\^\\M-]\\\cr\^\\M-]\\\c'M-^?^ZM-a^@^P\^M-\\M-]\\\\\^O\H\\\\\^O\H\
dualbus@debian:~/bash-fuzzing/bash-parser$ base64 output/13/crashes/id:000042,sig:11,src:005617,op:havoc,rep:4 Zm9yICgoMGZ1bmOOaW9uOykpOyBkbyA6vuHSvr5lJgpkfwBlIDo7IGRvbmUm92RcXFxjciRcb3Ph Y1xc4WNcXF5cXN1cXlxc3VxcXGNyXF5cXN1cXFxjJ/8a4QAQXF7cU91cXFxcXA9cSFxcXFzFc+Fj XFzhY1xcXlxc3VxeXFzdXFxcY3JcXlxc3VxcXGMn/xrhABBcXtxc3VxcXFxcD1xIXFxcXFwPXEhc dualbus@debian:~/bash-fuzzing/bash-parser$ md5sum output/13/crashes/id:000042,sig:11,src:005617,op:havoc,rep:4 d68c7d167e171a2f42b6af52490eb2c8 output/13/crashes/id:000042,sig:11,src:005617,op:havoc,rep:4 (gdb) r -n output/13/crashes/id:000042,sig:11,src:005617,op:havoc,rep:4 Starting program: /home/dualbus/src/gnu/bash/bash -n output/13/crashes/id:000042,sig:11,src:005617,op:havoc,rep:4 output/13/crashes/id:000042,sig:11,src:005617,op:havoc,rep:4: line 1: syntax error: arithmetic expression required output/13/crashes/id:000042,sig:11,src:005617,op:havoc,rep:4: line 1: syntax error: `((0func�ion;))' ^C Program received signal SIGINT, Interrupt. 0x00007ffff76e8540 in __read_nocancel () at ../sysdeps/unix/syscall-template.S:84 84 ../sysdeps/unix/syscall-template.S: No such file or directory. (gdb) bt #0 0x00007ffff76e8540 in __read_nocancel () at ../sysdeps/unix/syscall-template.S:84 #1 0x00000000004e9393 in zread (fd=255, buf=0x829a08 "", len=171) at zread.c:56 #2 0x000000000048f8ec in b_fill_buffer (bp=0x828ec8) at input.c:499 #3 0x000000000048f76c in buffered_getchar () at input.c:563 #4 0x0000000000431a8b in yy_getc () at ./parse.y:1389 #5 0x0000000000432328 in shell_getc (remove_quoted_newline=1) at ./parse.y:2289 #6 0x0000000000430bb7 in read_token (command=0) at ./parse.y:3138 #7 0x000000000042c14e in yylex () at ./parse.y:2675 #8 0x0000000000428abe in yyparse () at y.tab.c:1827 #9 0x00000000004285ab in parse_command () at eval.c:294 #10 0x0000000000428392 in read_command () at eval.c:338 #11 0x0000000000428091 in reader_loop () at eval.c:140 #12 0x00000000004253bb in main (argc=3, argv=0x7fffffffe438, env=0x7fffffffe458) at shell.c:794
