Package: bash
Version: 5.2.15-2+b2
Severity: normal
X-Debbugs-Cc: bugs.debian....@wongs.net
Dear Maintainer,
Using history-search-backward and -forward can cause bash to die with
an error:
free(): double free detected in tcache 2
Aborted (core dumped)
This is easily replicated by binding keys to run the history-search-
functions. Start up a fresh bash shell and type the following.
bind '"\C-p": history-search-backward'
bind '"\C-n": history-search-forward'
^P^U^P^U^N^J
Bash will immediately crash.
Note ^ means hold down the control key while pressing the next letter.
So, in the above example, you'd by hitting:
Control-P # history-search-backward
Control-U # unix-line-discard
Control-P # history-search-backward
Control-U # unix-line-discard
Control-N # history-search-forward
Control-J # accept-line
-- System Information:
Debian Release: 12.0
APT prefers testing-security
APT policy: (500, 'testing-security'), (500, 'testing')
Architecture: amd64 (x86_64)
Kernel: Linux 6.1.0-9-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages bash depends on:
ii base-files 12.4
ii debianutils 5.7-0.4
ii libc6 2.36-9
ii libtinfo6 6.4-4
Versions of packages bash recommends:
ii bash-completion 1:2.11-6
Versions of packages bash suggests:
ii bash-doc 5.2.15-2
-- no debconf information
