On Wed, 10 Jun 2026 04:54:24 +0200,
Luigi Vianello <[email protected]> wrote:
>
> >Synopsis: ksh segfault
> >Category: user
> >Environment:
> System : OpenBSD 7.9
> Details : OpenBSD 7.9 (GENERIC.MP) #449: Wed May 6 13:17:25 MDT 2026
> [email protected]:/usr/src/sys/arch/amd64/compile/GENERIC.MP
> Architecture: OpenBSD.amd64
> Machine : amd64
>
> >Description:
> ksh crashes after setting the PS1 variable and running set -o randomstring
> I encountered this bug while playing with gemini. My intention
> was to create a way to save the timestamp in ksh's history for each
> command typed.
> The bug is always reproducible.
> I'm not attaching the dmesg because I don't think it's relevant. If it is,
> I'll create a new report with the necessary attachments.
>
> >How-To-Repeat:
> The problem is easily reproducible by setting the following variable PS1
> $ PS1='$(printf "# [%s]\n" "$(date "+%Y-%m-%d %H:%M:%S")" | read
> -s)$USER@$(hostname -s):$PWD$ '
> and then
> $ set -o bye
> ksh: set: bye: bad option
> Segmentation fault (core dumped)
> $ ls -al ksh.core
> -rw------- 1 testuser testuser 4831840 Jun 10 03:48 ksh.core
>
Thanks for report.
unwind() may clear source while popping execution environments. The
interactive shell then expands PS1 before compile() restores source, so
a prompt command substitution using read -s can dereference NULL while
saving history. Restore source to the current interactive input source
before continuing to the prompt loop.
Ok?
Index: bin/ksh/main.c
===================================================================
RCS file: /home/cvs/src/bin/ksh/main.c,v
diff -u -p -r1.100 main.c
--- bin/ksh/main.c 23 Jul 2023 23:42:03 -0000 1.100
+++ bin/ksh/main.c 13 Jun 2026 23:08:05 -0000
@@ -587,6 +587,7 @@ shell(Source *volatile s, volatile int t
*/
/* toss any input we have so far */
s->start = s->str = null;
+ source = s;
break;
}
/* FALLTHROUGH */
--
wbr, Kirill
