Configuration Information [Automatically generated, do not change]:
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS: -g -O2
uname output: Linux ALBERTO 6.6.87.2-microsoft-standard-WSL2 #1 SMP
PREEMPT_DYNAMIC Thu Jun  5 18:30:46 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
Machine Type: x86_64-pc-linux-gnu

Bash Version: 5.2
Patch Level: 37
Release Status: release

Description:
    When I define an alias and a function with the same name, I experience
abnormal behavior.
    It seems to be especially dangerous when using a colon.

Repeat-By:
    Some examples (in Markdown).
    ```bash
    alias x='echo foo'
    x(){ :;}

    # It return:
    # -bash: syntax error near unexpected token `('
    ```

    ```bash
    alias x='echo foo;'
    x(){ :;}

    # It return similar but diferent error:
    # -bash: syntax error near unexpected token `)'
    ```

    ```bash
    alias x=:
    x(){ :;} # Not error yet but...

    x
    # It return:
    # Segmentation fault (core dumped)
    ```
    And this is de dump in `dmesg -H`:
    ```
    [Jun18 16:29] bash: bash: potentially unexpected fatal signal 11.
    [  +0.000720] CPU: 2 PID: 63671 Comm: bash Not tainted
6.6.87.2-microsoft-standard-WSL2 #1
    [  +0.000661] RIP: 0033:0x5d2f6479d7db
    [  +0.000491] Code: 63 04 a1 48 c1 ea 03 48 01 c8 3e ff e0 66 90 b9 1c
00 00 00 89 0d b1 40 05 00 e9 9d fb ff ff 4c 89 c7 4c 89 e2 be df 00 00 00
<e8> 20 4b f3 ff 49 89 c0 e9 13 fe ff ff 39 fb 0f 8f 68 fd ff ff 8b
    [  +0.001535] RSP: 002b:00007ffc8af5df20 EFLAGS: 00010206
    [  +0.000755] RAX: 00005d2f693d1480 RBX: 0000000000000070 RCX:
00005d2f693d1400
    [  +0.000968] RDX: 0000000000000070 RSI: 00000000000000df RDI:
00005d2f693d1410
    [  +0.000564] RBP: 0000000000000003 R08: 00005d2f693d1410 R09:
0000000000001000
    [  +0.000586] R10: 00005d2f647f1890 R11: 0000000000000000 R12:
0000000000000070
    [  +0.000558] R13: 00005d2f647a30a8 R14: 0000000000002b01 R15:
00005d2f647f18c0
    [  +0.000577] FS:  00007725b774e740 GS:  0000000000000000
    [  +0.002098] WSL (63798 - CaptureCrash): Capturing crash for pid:
60321, executable: !home!alberto!ramfs!bash!bash-master!bash, signal: 11,
port: 50005
    ```

    And when you put a colon at the end of the alias, the function
definition executes the alias.
    ```bash
    alias x='id;:'
    x(){ :;}

    # It return the execution of the alias:
    # uid=1000(alberto) gid=1000(alberto) groups=1000(alberto),...

    # And if you try to execute the alias/function, execute the alias and
crash:
    x
    # uid=1000(alberto) gid=1000(alberto) groups=1000(alberto),...
    # Segmentation fault (core dumped)
    ```

    Some extra examples:
    ```bash
    bash -i -c $'alias x=:\n         x(){ :;};x' # This crash.
    bash    -c $'alias x=:\n         x(){ :;};x' # This do not crash.
    bash -i -c $'alias x=:\nfunction x(){ :;};x' # This do not crash.
    bash -i -c  'alias x=:; function x(){ :;};x' # This do not crash.
    bash -i -c  'alias x=:;          x(){ :;};x' # This do not crash.
    ```
Bye.

Reply via email to