Bug 832421

Summary: eval segmentation fault with output over 333 lines..
Product: Red Hat Enterprise Linux 5 Reporter: richard rigby <r.rigby>
Component: tcshAssignee: Fridolín Pokorný <fpokorny>
Status: CLOSED WONTFIX QA Contact: BaseOS QE - Apps <qe-baseos-apps>
Severity: low Docs Contact:
Priority: unspecified    
Version: 5.9CC: ovasik
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-04-09 12:40:50 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description richard rigby 2012-06-15 11:31:27 UTC
Description of problem:

in tcsh, it seems that if the output from eval `x` is greater than 333 lines, a segmentation fault occurs.

Version-Release number of selected component (if applicable):

tcsh-6.14-17

How reproducible:

always

Steps to Reproduce:

% cat test.sh
#!/bin/sh

ECHO=/bin/echo

for i in `seq 1 1000`
do
        echo "$ECHO $i ;"
done

% eval `test.sh` | egrep '.*'
1
2
3
...
332
333
Segmentation fault
  
Actual results:

segmentation fault

Expected results:

no error

Additional info:

also tested on a el6.2/x86_64 system, which returned no error.

Comment 1 richard rigby 2013-01-18 14:11:48 UTC
bug still exists in 5.9 - the tcsh package has been updated, as far as i can tell.
bug does not seem to exist in the tcsh617 package.

thanks, 

richard

Comment 2 Fridolín Pokorný 2013-04-09 12:40:50 UTC
Old release of tcsh-6.14.00 does not support dynamically allocated buffers (available since tcsh-6.14.03) so buffers can easily overflow like in your example.

This one issue is fixed in RHEL-6 therefore I am closing the bug as
WONTFIX.