Bug 1970314

Summary:	"stack smashing detected" in CentOS Docker container following upgrade from 8.3.201 to 8.4.2105
Product:	Red Hat Enterprise Linux 8	Reporter:	INVADE International Ltd. <third.line>
Component:	bash	Assignee:	Siteshwar Vashisht <svashisht>
Status:	CLOSED WORKSFORME	QA Contact:	Karel Volný <kvolny>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.4
Target Milestone:	beta
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-12 09:17:28 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description INVADE International Ltd. 2021-06-10 08:48:51 UTC

Description of problem:
Use of non escaped tilde (~) causes buffer overflow.

Raising here as requested in:
https://forums.centos.org/viewtopic.php?f=54&t=77702

Note : I am experiencing this in CentOS. I have no way to test in RHEL.


Version-Release number of selected component (if applicable):
4.4.20-1.el8_4

How reproducible:
Always


Steps to Reproduce:
1. Start a container using the latest (8.3.201) Docker image.

2. dnf makecache

3. dnf upgrade (which upgrades to 8.4.2105)

4. VERSION=~rc1


Actual results:
*** stack smashing detected ***: <unknown> terminated


Expected results:
Either variable set or error to say user rc1 doesn't exist.


Additional info:
Escaping the tilde resolves the problem:
4. VERSION=\~rc1

Not sure if this is a problem with bash itself, it's the environment I am experiencing the problem in.

Comment 1 Siteshwar Vashisht 2021-10-12 09:17:28 UTC

I have not been able to reproduce this bug with 'CentOS Linux release 8.4.2105'. I followed below steps:

On the host:

```
docker pull centos
docker run -it bash
```

Inside the container:

```
# dnf makecache
# dnf upgrade
# VERSION=~rc1
# echo $VERSION
~rc1
```

So it works as expected. I will close this as worksforme.

Please reopen if you are still able to reproduce it.