Bug 683722

Summary: ksh crashes when IFS is unset inside a function
Product: Red Hat Enterprise Linux 5 Reporter: Siddhesh Poyarekar <spoyarek>
Component: kshAssignee: Michal Hlavinka <mhlavink>
Status: CLOSED ERRATA QA Contact: qe-baseos-tools-bugs
Severity: high Docs Contact:
Priority: urgent    
Version: 5.5CC: dcleal, ifloodmu, kvolny, liko, mfranc, mnewsome, msvoboda, ovasik, prc
Target Milestone: rcKeywords: Patch, ZStream
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
The KornShell's "IFS" variable contains a list of field separators and is used to separate the results of command substitution, parameter expansion, or separate fields with the "read" built-in command. Previously, ksh did not protect this variable from being freed. Consequent to this, when a user attempted to unset the "IFS" variable from within a function, ksh terminated unexpectedly with a segmentation fault. With this update, an upstream patch has been applied to address this issue, and using the "unset IFS" command inside a function body no longer causes ksh to crash.
Story Points: ---
Clone Of:
: 683734 (view as bug list) Environment:
Last Closed: 2012-02-21 05:50:33 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 683734, 684829, 727223, 727891    
Attachments:
Description Flags
Ensure that IFS.nofree is set during init none

Description Siddhesh Poyarekar 2011-03-10 06:57:16 UTC
Description of problem:
ksh crashes when IFS is unset inside a function

Version-Release number of selected component (if applicable):
ksh-20100202-1.el5_6.3

How reproducible:
Always

Steps to Reproduce:
Execute the following script:

-----------------------
#!/bin/ksh

function crash
{
  typeset IFS
  unset IFS
  cd
  print "hello"
}

crash
-----------------------
  
Actual results:
segfault

Expected results:
hello

Additional info:
This has been fixed upstream in ksh-20101010 and later. Relevant mail thread:

https://mailman.research.att.com/pipermail/ast-developers/2010q4/000785.html

Comment 2 Siddhesh Poyarekar 2011-03-10 07:01:33 UTC
Created attachment 483373 [details]
Ensure that IFS.nofree is set during init

Comment 9 Miroslav Svoboda 2012-01-18 08:59:35 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
The KornShell's "IFS" variable contains a list of field separators and is used to separate the results of command substitution, parameter expansion, or separate fields with the "read" built-in command. Previously, ksh did not protect this variable from being freed. Consequent to this, when a user attempted to unset the "IFS" variable from within a function, ksh terminated unexpectedly with a segmentation fault. With this update, an upstream patch has been applied to address this issue, and using the "unset IFS" command inside a function body no longer causes ksh to crash.

Comment 10 errata-xmlrpc 2012-02-21 05:50:33 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0159.html