Configuration Information [Automatically generated, do not change]:
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS: -O2 -flto=auto -ffat-lto-objects -fexceptions -g
-grecord-gcc-switches -pipe -Wall -Werror=format-security
-Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS
-specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong
-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -march=x86-64
-mtune=generic -fasynchronous-unwind-tables -f
stack-clash-protection -fcf-protection -mtls-dialect=gnu2
-fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -std=gnu17
uname output: Linux fedora-desktop 7.2.9-200.fc44.x86_64 #1 SMP
PREEMPT_DYNAMIC Sat Oct 3 19:59:55 UTC 2026 x86_64 GNU/Linux
Machine Type: x86_64-redhat-linux-gnu
Bash Version: 5.3
Patch Level: 9
Release Status: release
Description:
It looks like there is a segmentation fault due to an integer
overflow in the strip_trailing function in stringlib.c.
I was trying some stupid inputs for a school project that requires
an option to read a value from argv and display it in stdout. I wondered
how to handle the case where a ridiculously large argument (several GB) is
passed. I tried a huge VM drive file (about 18GB) using command expansion
and bash crashed with a SIGSGEV.
The command looks like this: ```bash$ ./prog "$(cat my_huge_file)"```
I retried the same thing but this time just calling $(cat
my_huge_file) directly as a command name and the same crash occurred.
I recompiled bash from source with these options (./configure
CFLAGS='-O0 -g' --without-bash-malloc --with-installed-readline) to get
more informations with gdb because the len value was set to <optimized out>.
With this recompiled version I get the same crash again and len
value was set to a huge negative number.
The len variable is an int so the string array max size is about 2GB
but my input was more than 3GB. I have tried with a smaller file (1GB) and
the crash didn't occur.
With files larger than 2GB len overflow and you read and write the
\0 in random memory address.
Repeat-By:
All you have to do is work on a string larger than 2GB. It can be a
command name or an argument passed to another program, anything parsed by
bash.
Fix:
Change len type from int to size_t and/or limit the max size of
strings manipulated by bash.
