Re: bash-4.3_p39 Segfaults in array_flush at array.c:111 after incorrect conversion from indexed to associative array

[Chet Ramey]

On 8/15/15 9:02 PM, Sergey Tselikh wrote:

> Description:
> An incorrect conversion from indexed to associative array in bash script leads
> bash interpreter to segfault (bash still gives a useful error report in this 
> situation,
> which is good).
> 
> As seen in the output of GDB, bash terminates in array_flush function:
> 
> Core was generated by `../untars/bash-43-39/bash-4.3/root/bin/bash -x repro'.
> Program terminated with signal SIGSEGV, Segmentation fault.
> #0  0x0000000000470879 in array_flush (a=0x19de728) at array.c:111
> 111             for (r = element_forw(a->head); r != a->head; ) {

Thanks for the report.  The problem was incomplete error propagation.  It
will be fixed for the next release of bash.

I've attached a patch for folks to experiment with; your line numbers will
vary wildly.


Chet

-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, ITS, CWRU    c...@case.edu    http://cnswww.cns.cwru.edu/~chet/

*** /fs2/chet/bash/bash-20150813/subst.c	2015-08-13 11:32:54.000000000 -0400
--- subst.c	2015-08-18 10:13:59.000000000 -0400
***************
*** 10139,10143 ****
  	  opts[opti] = '\0';
  	  if (opti > 0)
! 	    make_internal_declare (tlist->word->word, opts);
  
  	  t = do_word_assignment (tlist->word, 0);
--- 10139,10150 ----
  	  opts[opti] = '\0';
  	  if (opti > 0)
! 	    {
! 	      t = make_internal_declare (tlist->word->word, opts);
! 	      if (t != EXECUTION_SUCCESS)
! 		{
! 		  last_command_exit_value = t;
! 		  exp_jump_to_top_level (DISCARD);
! 		}
! 	    }
  
  	  t = do_word_assignment (tlist->word, 0);