Bug 145968 (IT_63853)

Summary:	bash segfaults on very long command-line
Product:	Red Hat Enterprise Linux 3	Reporter:	Thomas Uebermeier <uthomas>
Component:	bash	Assignee:	Tim Waugh <twaugh>
Status:	CLOSED WORKSFORME	QA Contact:	Ben Levenson <benl>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	3.0	CC:	tao
Target Milestone:	---
Target Release:	---
Hardware:	i386
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-03-06 23:39:28 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	132991

Description Thomas Uebermeier 2005-01-24 13:57:49 UTC

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3)
Gecko/20041020

Description of problem:
This bug is for tracking the backport of
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=109269, which is
filed for Fedora and should be backportable.
Information taken from that bug report.

Version-Release number of selected component (if applicable):
bash-2.05b-29.0.3

How reproducible:
Always

Steps to Reproduce:
Steps to Reproduce (Don't ask why I did this): 
1. open bugzilla's query page 
2. mark every product/version/component/status/resolution 
3. press search 
4. abort search (it won't complete anyway) 
5. mark URL and paste it into bash (its insanely long) 

Actual Results:  Actual results: 
bash aborts with segfault: 
free(): invalid pointer 0x8224600! 
 
Program received signal SIGSEGV, Segmentation fault. 
0x006a277d in malloc_consolidate () from /lib/tls/libc.so.6 
(gdb) bt 
#0  0x006a277d in malloc_consolidate () from /lib/tls/libc.so.6 
#1  0x006a1d5a in _int_malloc () from /lib/tls/libc.so.6 
#2  0x006a110d in malloc () from /lib/tls/libc.so.6 
#3  0x08091517 in xmalloc () 
#4  0x080a4291 in readline_internal_teardown () 
#5  0x080a4588 in readline_internal_char () 
#6  0x08083480 in termination_unwind_protect () 

Additional info:

Comment 1 Bastien Nocera 2005-01-24 14:21:49 UTC

*** Bug 145977 has been marked as a duplicate of this bug. ***

Comment 2 Tim Waugh 2005-01-27 13:00:18 UTC

I can't reproduce this from the description.  Could you attach the line that you
paste in please?

Comment 3 Tim Waugh 2005-02-07 11:30:16 UTC

*ping*

Comment 4 Tim Waugh 2005-02-28 10:48:08 UTC

I can't reproduce this from the description.  Could you attach the line that you
paste in please?