Re: Segmentation fault in pat_subst

[Chet Ramey]

On 7/20/19 6:23 PM, Eduardo A. Bustamante López wrote:
> Bash `devel' crashes under the following circumstances:
> 
> | dualbus@system76-pc:/tmp/build-bash-devel$ CFLAGS='-O0 -ggdb' 
> ~/src/gnu/bash/configure --with-bash-malloc
> | (...)
> | dualbus@system76-pc:/tmp/build-bash-devel$ make -j$(nproc)
> | (...)
> | dualbus@system76-pc:/tmp/build-bash-devel$ ./bash -c $'x=0; : 
> ${x/#[0\xef\xbf\xbd\\Z[:]]}'
> | Segmentation fault (core dumped)

> I have been looking around but I don't understand what's going on. I can see
> that the value of `str' comes from `e', which in turn comes from
> `match_pattern', but it's not clear to me why this is happening.

Thanks for the report. Look at match_wpattern and consider what happens if
wmatchlen returns something longer than the string length. It will be fixed
for the next devel branch push.

Chet

-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, UTech, CWRU    chet@case.edu    http://tiswww.cwru.edu/~chet/