(tested against the latest devel, i.e. May/8 push)
dualbus@debian:~/src/gnu/bash$ git rev-parse HEAD
af2a77fbbcf6e50edbc535eb3fd267bd3f4d1a14
dualbus@debian:~/bash-fuzzing/bash-read/read-r$ cat -v read_builtin
00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000M-lM-=M-=00M-|
dualbus@debian:~/bash-fuzzing/bash-read/read-r$ base64 read_builtin
MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw
MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDDsvb0wMPw=
dualbus@debian:~/bash-fuzzing/bash-read/read-r$ md5sum read_builtin
dd5d776c6dc83e57a64034bb6cfee574 read_builtin
(gdb) r -c 'read -r < read_builtin'
Starting program: /home/dualbus/src/gnu/bash/bash -c 'read -r < read_builtin'
malloc: ./read.def:806: assertion botched
malloc: 0x829f88: allocated: last allocated from ./read.def:361
free: start and end chunk sizes differ
Aborting...
Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
51 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1 0x00007ffff76413fa in __GI_abort () at abort.c:89
#2 0x000000000045c745 in programming_error (format=0x551e9b "free:
start and end chunk sizes differ") at error.c:175
#3 0x00000000005335c2 in xbotch (mem=0x829f88, e=8, s=0x551e9b "free:
start and end chunk sizes differ",
file=0x54c793 "./read.def", line=806) at malloc.c:329
#4 0x0000000000532b6e in internal_free (mem=0x829f88, file=0x54c793
"./read.def", line=806, flags=1) at malloc.c:916
#5 0x0000000000532888 in sh_free (mem=0x829f88, file=0x54c793
"./read.def", line=806) at malloc.c:1271
#6 0x00000000004b811e in sh_xfree (string=0x829f88, file=0x54c793
"./read.def", line=806) at xmalloc.c:221
#7 0x00000000004cc741 in read_builtin (list=0x0) at ./read.def:806
#8 0x000000000044efaf in execute_builtin (builtin=0x4cad80
<read_builtin>, words=0x8297e8, flags=0, subshell=0)
at execute_cmd.c:4605
#9 0x000000000044e3e0 in execute_builtin_or_function (words=0x8297e8,
builtin=0x4cad80 <read_builtin>, var=0x0, redirects=0x829988,
fds_to_close=0x8299c8, flags=0) at execute_cmd.c:5103
#10 0x0000000000447095 in execute_simple_command
(simple_command=0x827f48, pipe_in=-1, pipe_out=-1, async=0,
fds_to_close=0x8299c8)
at execute_cmd.c:4391
#11 0x0000000000444b71 in execute_command_internal (command=0x827f08,
asynchronous=0, pipe_in=-1, pipe_out=-1, fds_to_close=0x8299c8)
at execute_cmd.c:812
#12 0x00000000004c1fd7 in parse_and_execute (string=0x827b48 "read -r
< read_builtin", from_file=0x535b6f "-c", flags=4)
at evalstring.c:430
#13 0x00000000004271af in run_one_command (command=0x7fffffffe6fc
"read -r < read_builtin") at shell.c:1405
#14 0x00000000004251fd in main (argc=3, argv=0x7fffffffe448,
env=0x7fffffffe468) at shell.c:718
