Re: Heap-buffer-overflow in read_token_word() when read element with -1 index

[Chet Ramey]

On 4/23/25 1:37 PM, Grisha Levit wrote:

On Wed, Apr 23, 2025, 11:40 Chet Ramey <chet.ra...@case.edu> wrote:

On 4/23/25 11:30 AM, Александр Ушаков wrote:

I encountered an issue in Bash and would like to report it. buggyfile.txt is 
attached to the email.

Steps to reproduce

$ CC=clang-19 CFLAGS="-fsanitize=address -g -O0" ./configure 
--without-bash-malloc
$ make
$ cat crash1.txt | ./bash --norc --noediting -i

I get no asan errors when running that file against the current bash devel
branch and bash-5.3-rc1.

I think the attachment has incorrect line endings, here's what I believe is a
simplified reproducer:

     bash --norc -in -o posix <<< $':\n"\n"$(!!'

Thanks for the reproducer; that made it easy to find.


--
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, UTech, CWRU    c...@case.edu    http://tiswww.cwru.edu/~chet/

OpenPGP_signature.asc
Description: OpenPGP digital signature