Bug 109269

Summary:	bash segfaults with very long commandline
Product:	[Fedora] Fedora	Reporter:	Karsten Hopp <karsten>
Component:	bash	Assignee:	Tim Waugh <twaugh>
Status:	CLOSED RAWHIDE	QA Contact:	Ben Levenson <benl>
Severity:	medium	Docs Contact:
Priority:	high
Version:	rawhide	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	2.05b-32	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2003-11-06 12:09:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Karsten Hopp 2003-11-06 11:21:55 UTC

Description of problem: 
bash segfaults with very long commandline. 
Seems to need some special characters in the commandline, doesn't  
happen with normal text. 
 
 
 
Version-Release number of selected component (if applicable): 
bash-2.05b-30 
 
How reproducible: 
always 
 
Steps to Reproduce (Don't ask why I did this): 
1. open bugzilla's query page 
2. mark every product/version/component/status/resolution 
3. press search 
4. abort search (it won't complete anyway) 
5. mark URL and paste it into bash (its insanely long) 
   
Actual results: 
bash aborts with segfault: 
free(): invalid pointer 0x8224600! 
 
Program received signal SIGSEGV, Segmentation fault. 
0x006a277d in malloc_consolidate () from /lib/tls/libc.so.6 
(gdb) bt 
#0  0x006a277d in malloc_consolidate () from /lib/tls/libc.so.6 
#1  0x006a1d5a in _int_malloc () from /lib/tls/libc.so.6 
#2  0x006a110d in malloc () from /lib/tls/libc.so.6 
#3  0x08091517 in xmalloc () 
#4  0x080a4291 in readline_internal_teardown () 
#5  0x080a4588 in readline_internal_char () 
#6  0x08083480 in termination_unwind_protect () 
 
 
Expected results: 
 
 
Additional info: 
probably a readline problem

Comment 1 Tim Waugh 2003-11-06 12:09:24 UTC

Please verify that 2.05b-32 fixes it for you.