Bug 650363

The actual alias is
alias delenv 'eval `delenv.pl \!*`'

Robert, do you have any other reproducer?
Unfortunately, I can't find out any test case to crash the program.

Created attachment 492179 [details]
Demonstrate core dump with multiple backtick evaluation

Please extract into /var/tmp

Thank you for the reproducer, Robert!

The bug will be solved by new component tcsh617 in RHEL-5.7, moving bz to this new component.
Pword() and other string related functions are rewritten from scratch in tcsh 6.17 so there is no such buffer overflow as described below.

---
Details of the issue in tcsh 6.14:

Core dump:

Program terminated with signal 11, Segmentation fault.
#0  0x0000000000414a2e in pword (bufsiz=10240) at sh.glob.c:1094
1094        pargv[pargc++] = Strsave(pargs);
(gdb) bt
#0  0x0000000000414a2e in pword (bufsiz=10240) at sh.glob.c:1094
#1  0x0000000000416049 in dobackp (cp=<value optimized out>, literal=0) at sh.glob.c:835
#2  0x00000000004160e6 in globexpand (v=0x6d5e70) at sh.glob.c:356
#3  0x0000000000416518 in globall (v=0x6d5e68) at sh.glob.c:707
#4  0x0000000000413664 in doeval (v=<value optimized out>, c=<value optimized out>) at sh.func.c:2337
#5  0x0000000000421534 in execute (t=0x6dace0, wanttty=<value optimized out>, pipein=0x0, pipeout=0x0, do_glob=1) at sh.sem.c:652
#6  0x0000000000421042 in execute (t=0x6daca0, wanttty=-1, pipein=0x0, pipeout=0x0, do_glob=1) at sh.sem.c:740
#7  0x000000000040424f in process (catch=1) at sh.c:2180
#8  0x0000000000405edb in main (argc=<value optimized out>, argv=<value optimized out>) at sh.c:1362

Patch to fix the issue (fixes possible buffer overflow when pargc is greater than exact tested value):

--- sh.glob.c-orig      2011-04-18 15:14:08.614338311 +0200
+++ sh.glob.c   2011-04-18 15:14:13.122425349 +0200
@@ -1085,7 +1085,7 @@ pword(bufsiz)
     int    bufsiz;
 {
     psave(0);
-    if (pargc == pargsiz - 1) {
+    if (pargc >= pargsiz - 1) {
        pargsiz += GLOBSPACE;
        pargv = (Char **) xrealloc((ptr_t) pargv,
                                   (size_t) (pargsiz * sizeof(Char *)));

---
Unfortunately, the simple patch reveals another weird bug (glibc related):

Program terminated with signal 11, Segmentation fault.
#0  _int_malloc (av=0x3c699971c0, bytes=<value optimized out>) at malloc.c:4628
4628            size = chunksize(victim);
(gdb) bt
#0  _int_malloc (av=0x3c699971c0, bytes=<value optimized out>) at malloc.c:4628
#1  0x0000003c69679ffd in __libc_malloc (bytes=24) at malloc.c:3660
#2  0x000000000043c052 in smalloc (n=24) at tc.alloc.c:498
#3  0x000000000041bd58 in lex (hp=0x678d20) at sh.lex.c:188
#4  0x00000000004040db in process (catch=0) at sh.c:2097
#5  0x000000000041373f in doeval (v=<value optimized out>, c=<value optimized out>) at sh.func.c:2372
#6  0x0000000000421534 in execute (t=0xcda0c0, wanttty=<value optimized out>, pipein=0x0, pipeout=0x0, do_glob=1) at sh.sem.c:652
#7  0x0000000000421042 in execute (t=0xcda080, wanttty=-1, pipein=0x0, pipeout=0x0, do_glob=1) at sh.sem.c:740
#8  0x000000000040424f in process (catch=1) at sh.c:2180
#9  0x0000000000405edb in main (argc=<value optimized out>, argv=<value optimized out>) at sh.c:1362

Reproducer:

#!/bin/tcsh
alias testecho '`echo echo \!*`'
testecho This works
testecho This core dumps `echo me`

Should the reproducer be

#!/bin/tcsh
alias testecho 'echo `echo \!*`'
testecho This works
testecho This core dumps `echo me`

Notice the change in testecho alias.

Robert, both variants are OK..

$ `echo echo ...`
...
$ echo `echo ...`
...

Bugfix was successfully verified on tcsh617-6.17-5.el5 package.

tcsh can handle multiple backtick evaluation now.

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
When tcsh evaluated a backquoted command (using command substitution) which itself contained backquotes, it could have dumped core due to a buffer overflow. With this update, nested command substitutions are now handled correctly, and tcsh no longer dumps core in this situation.

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-1072.html

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-1072.html

Errata contains a small grammar error.  It currently reads "An new tcsh617 package".  It should read "A new tcsh617 package"