Configuration Information [Automatically generated, do not change]:
Machine: arm
OS: linux-gnueabihf
Compiler: gcc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='arm'
-DCONF_MACHTYPE='arm-unknown-linux-gnueabihf' -DCONF_VENDOR='unknown'
-DLOCALEDIR='/usr/share/locale' -DPACKAGE='bash' -DSHELL -DHAVE_CONFIG_H
  -I.  -I../. -I.././include -I.././lib  -D_FORTIFY_SOURCE=2 -g -O2
-fstack-protector --param=ssp-buffer-size=4 -Wformat
-Werror=format-security -Wall
uname output: Linux odroid-004 #1 SMP PREEMPT Mon Dec 1
17:16:28 BRST 2014 armv7l armv7l armv7l GNU/Linux
Machine Type: arm-unknown-linux-gnueabihf

Bash Version: 4.3
Patch Level: 11
Release Status: release

Actually also works on Bash-4.4 patch 12, x86, etc.
The following bash commands crash the bash:
But they are all triggered by the same bug. These were found by using

        Just type in the above commands. If it doesn't work you can also try
echo -ne '<&-<${}'|bash
        Check for null pointer here:
Program received signal SIGSEGV, Segmentation fault.
0x000912a8 in buffered_getchar () at input.c:565
565   return (bufstream_getc (buffers[bash_input.location.buffered_fd]));
(gdb) bt
#0  0x000912a8 in buffered_getchar () at input.c:565
#1  0x0002f87c in yy_getc () at /usr/homes/chet/src/bash/src/parse.y:1390
#2  0x000302cc in shell_getc (remove_quoted_newline=1) at
#3  0x0002e928 in read_token (command=0) at
#4  0x00029d2c in yylex () at /usr/homes/chet/src/bash/src/parse.y:2675
#5  0x000262cc in yyparse () at
#6  0x00025efc in parse_command () at eval.c:261
#7  0x00025de8 in read_command () at eval.c:305
#8  0x00025a70 in reader_loop () at eval.c:149
#9  0x0002298c in main (argc=1, argv=0xbefff824, env=0xbefff82c) at
(gdb) p bash_input.location.buffered_fd
$1 = 0
(gdb) p buffers
$2 = (BUFFERED_STREAM **) 0x174808
(gdb) x/10x 0x174808
0x174808:   0x00000000  0x00000000  0x00000000  0x00000000
0x174818:   0x00000000  0x00000000  0x00000000  0x00000000
0x174828:   0x00000000  0x00000000

Reply via email to