*Synopsis*: "echo ${test}" with test undefined crashes the shell

CR 6848486 changed on Nov 23 2009 by <User 1-2S67RN>

=== Field ============ === New Value ============= === Old Value =============

Integrated in Build    snv_128                                                
Status                 10-Fix Delivered            8-Fix Available            
====================== =========================== ===========================

     
*Change Request ID*: 6848486

*Synopsis*: "echo ${test}" with test undefined crashes the shell

  Product: solaris
  Category: shell
  Subcategory: korn93
  Type: Defect
  Subtype: Functionality
  Status: 10-Fix Delivered
  Substatus: 
  Priority: 2-High
  Introduced In Release: solaris_nevada
  Introduced In Build: snv_72
  Responsible Engineer: <User 1-7MTUEB>
  Keywords: oss-request, oss-sponsor

=== *Description* ============================================================
This is an odd one:

$ ksh93 --version
  version         sh (AT&T Research) 93t 2008-11-04
$ ksh93
<email address omitted>:~$ echo $test

<email address omitted>:~$ echo ${test}                                         
           
Segmentation Fault (core dumped)

This doesn't crash on ksh88 BTW.

*** (#1 of 1): 2009-06-05 16:08:16 GMT+00:00 <User 1-5Q-10765>


=== *Public Comments* ========================================================
It seems a bit worse even:

<email address omitted>:~$ echo ${sleep}
Usage: sleep [ options ] seconds

So, builtin commands are evaluated.

*** (#1 of 2): 2009-06-05 16:46:25 GMT+00:00 <User 1-1SURPB>

The core dump problem is reproducible even on the lastest ksh93 code drop from 
upstream:

# echo ${test}
Segmentation Fault - core dumped
# mdb core
Loading modules: [ libc.so.1 ld.so.1 ]
> $c
libshell.so.1`b_test+0x6b()
libshell.so.1`sh_exec+0x302f()
libshell.so.1`sh_subshell+0x65c()
libshell.so.1`comsubst+0x8a2()
libshell.so.1`sh_macfun+0xc3()
libshell.so.1`varsub+0xe00()
libshell.so.1`copyto+0xb4a()
libshell.so.1`sh_macexpand+0x1f1()
libshell.so.1`arg_expand+0xa5()
libshell.so.1`sh_argbuild+0x9a()
libshell.so.1`sh_exec+0x213f()
libshell.so.1`exfile+0x786()
libshell.so.1`sh_main+0x7fe()
main+0x52()
0x400ccc()

But "sleep" problem is not there:

# echo ${sleep}

#

*** (#2 of 2): 2009-06-08 12:19:00 GMT+00:00 <User 1-1SURPB>


=== *Workaround* =============================================================

=== *Additional Details* =====================================================
        Targeted Release: solaris_nevada
        Commit To Fix In Build: snv_128
        Fixed In Build: snv_128
        Integrated In Build: snv_128
        Verified In Build: 
  See Also: 6437624, 6793763, 6857344
  Duplicate of: 
  Hooks:
        Hook1: 
        Hook2: 
        Hook3: 
        Hook4: 
        Hook5: <email address omitted>
        Hook6: <email address omitted>
  Program Management: 
  Root Cause: Inadequate Algorithm
  Fix Affects Documentation: No
  Fix Affects Localization: No

=== *History* ================================================================
        Date Submitted: 2009-06-05 16:08:15 GMT+00:00
        Submitted By: <User 1-5Q-10765>

        Status Changed    Date Updated                  Updated By
        3-Accepted        2009-06-05 16:51:03 GMT+00:00 <User 1-1SURPB>
        6-Fix Understood  2009-06-16 15:37:43 GMT+00:00 <User 1-1SURPB>
        7-Fix in Progress 2009-10-23 18:37:53 GMT+00:00 <User 1-7MTUEB>
        8-Fix Available   2009-10-28 18:23:37 GMT+00:00 <User 1-5HNZ8F>
        10-Fix Delivered  2009-11-23 05:17:10 GMT+00:00 <User 1-2S67RN>


=== *Service Request* ========================================================
        Impact: Critical
        Functionality: Nonessential
        Severity: 3
        Product Name: solaris
        Product Release: solaris_nevada
        Product Build: 
        Operating System: generic
        Hardware: generic
        Submitted Date: 2009-06-05 16:08:16 GMT+00:00


=== *Multiple Release (MR) Cluster* - 0 ======================================

Reply via email to