Bug 433662

Summary: bash segfaults in calling function when it's happening in recursion
Product: Red Hat Enterprise Linux 5 Reporter: Michal Nowak <mnowak>
Component: bashAssignee: Tomas Janousek <tjanouse>
Status: CLOSED UPSTREAM QA Contact: Ben Levenson <benl>
Severity: high Docs Contact:
Priority: low    
Version: 5.2CC: ohudlick
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-03-13 19:29:36 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
testcase causing bash to crash none

Description Michal Nowak 2008-02-20 18:28:36 UTC 
Description of problem:

When in bash script is function which calls itself repeatedly (recursion) it
causes bash to crash.

Version-Release number of selected component (if applicable):
bash-3.1-16.1

How reproducible:
always

Steps to Reproduce:
1. sh bash-kill.sh
  
Actual results:

dhcp-lab-198 mounting # time sh bash-kill.sh 
Segmentation fault

real    0m8.122s
user    0m8.005s
sys     0m0.088s


Expected results:
dhcp-lab-198 mounting # time sh bash-kill.sh 

+ as a bonus 100 % CPU usage forever
Comment 1 Michal Nowak 2008-02-20 18:28:36 UTC 
Created attachment 295437 [details]
testcase causing bash to crash
Comment 2 Tomas Janousek 2008-03-05 14:39:49 UTC 
Well, that's what unbounded recursion does in C as well. ksh solves this by
limiting the recursion depth (to something like 4096, which is not many).

We could limit it as well, but that won't give the results you expect. To get
that, bash would have to support tail recursion, and I guess that would be quite
an overkill for a shell.
Comment 3 Michal Nowak 2008-03-05 22:14:11 UTC 
Limiting it to some random number seems to me dumb, I don't see any number being
the Right One. User defined MAX_RECURSION=Int seems to me bad for debugging in
general.

The saner solution seems to me mentioned tail recursion.

When there's no agreement in upstream on expected behavior you can always close
it with note in docs that "this case does not have expected result", but that's
kinda coward, but viable.
Comment 4 Tomas Janousek 2008-03-09 15:07:58 UTC 
http://lists.gnu.org/archive/html/bug-bash/2008-03/msg00017.html
Comment 5 Michal Nowak 2008-03-09 19:25:38 UTC 
> http://lists.gnu.org/archive/html/bug-bash/2008-03/msg00005.html
> 
> ...including libsigsegv as an option for making stack overflow detection
> result in nicer output than a crash.

What about this? It's in Fedora.
Comment 6 Tomas Janousek 2008-03-13 19:29:36 UTC 
Well, we don't want to diverge from upstream, so I'll leave this up to them.