Bug 165243

Summary: crash from missing check for invalid multibyte strings when setting $IFS
Product: [Fedora] Fedora Reporter: Elliot Lee <sopwith>
Component: bashAssignee: Tim Waugh <twaugh>
Status: CLOSED RAWHIDE QA Contact: Ben Levenson <benl>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhide   
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: 3.0-33 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 539536 (view as bug list) Environment:
Last Closed: 2005-08-08 15:09:18 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Test case none

Description Elliot Lee 2005-08-05 19:32:31 UTC 
Line 6954 of subst.c, in the setifs function:

  if (!ifs_value)
    {
      ifs_firstc[0] = '\0';
      ifs_firstc_len = 1;
    }
  else
    {
      size_t ifs_len = strnlen (ifs_value, MB_CUR_MAX);
      ifs_firstc_len = mblen (ifs_value, ifs_len);
      memcpy (ifs_firstc, ifs_value, ifs_firstc_len);
    }

If the ifs_value string is not a valid multibyte string, mblen may return -1.
The subsequent memcpy causes a crash.

I'm not sure what the right outcome is, but crashing is not it :)
Comment 1 Elliot Lee 2005-08-05 19:34:31 UTC 
Created attachment 117500 [details]
Test case

The test case and bug info courtesy of Derek Pomery <nemo>
Comment 3 Tim Waugh 2005-08-08 15:09:18 UTC 
Should be fixed in bash-3.0-33.  Thanks for the report.