Segfault: Lone surrogate followed by locale change

[Egmont Koblinger]

Configuration Information [Automatically generated, do not change]:
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='x86_64'
-DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='x86_64-pc-linux-gnu'
-DCONF_VENDOR='pc' -DLOCALEDIR='/usr/share/locale' -DPACKAGE='bash'
-DSHELL -DHAVE_CONFIG_H   -I.  -I../. -I.././include -I.././lib
-Wdate-time -D_FORTIFY_SOURCE=2 -g -O2
-fdebug-prefix-map=/build/bash-IrsGKQ/bash-4.4=.
-fstack-protector-strong -Wformat -Werror=format-security -Wall
-no-pie -Wno-parentheses -Wno-format-security
uname output: Linux blacky 4.13.0-16-generic #19-Ubuntu SMP Wed Oct 11
18:35:14 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
Machine Type: x86_64-pc-linux-gnu

Bash Version: 4.4
Patch Level: 12
Release Status: release

Hi,

On Ubuntu Artful (glibc-2.26), this tiny snippet reproducibly crashes bash:

LC_ALL=en_US.UTF-8     # or any other UTF-8 locale
echo -e '\ud800'       # or any other lone high or low surrogate
LC_ALL=en_US.UTF-8     # or any available locale

I've discovered it in gnome-terminal. After sourcing
/etc/profile.d/vte-2.91.sh [1] and manually echoing a surrogate, from
then onwards the prompt takes a long time to display and I keep
getting system-crash-notification's "System program problem detected"
popup, as the subshell crashes at the locale change in
__vte_urlencode().

[1] https://git.gnome.org/browse/vte/tree/src/vte.sh?h=vte-0-50

Thanks a lot for looking into this,

egmont