Bug 145968 (IT_63853) - bash segfaults on very long command-line
Summary: bash segfaults on very long command-line
Keywords:
Status: CLOSED WORKSFORME
Alias: IT_63853
Product: Red Hat Enterprise Linux 3
Classification: Red Hat
Component: bash
Version: 3.0
Hardware: i386
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Tim Waugh
QA Contact: Ben Levenson
URL:
Whiteboard:
: 145977 (view as bug list)
Depends On:
Blocks: 132991
TreeView+ depends on / blocked
 
Reported: 2005-01-24 13:57 UTC by Thomas Uebermeier
Modified: 2007-11-30 22:07 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2005-03-06 23:39:28 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Thomas Uebermeier 2005-01-24 13:57:49 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3)
Gecko/20041020

Description of problem:
This bug is for tracking the backport of
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=109269, which is
filed for Fedora and should be backportable.
Information taken from that bug report.

Version-Release number of selected component (if applicable):
bash-2.05b-29.0.3

How reproducible:
Always

Steps to Reproduce:
Steps to Reproduce (Don't ask why I did this): 
1. open bugzilla's query page 
2. mark every product/version/component/status/resolution 
3. press search 
4. abort search (it won't complete anyway) 
5. mark URL and paste it into bash (its insanely long) 

Actual Results:  Actual results: 
bash aborts with segfault: 
free(): invalid pointer 0x8224600! 
 
Program received signal SIGSEGV, Segmentation fault. 
0x006a277d in malloc_consolidate () from /lib/tls/libc.so.6 
(gdb) bt 
#0  0x006a277d in malloc_consolidate () from /lib/tls/libc.so.6 
#1  0x006a1d5a in _int_malloc () from /lib/tls/libc.so.6 
#2  0x006a110d in malloc () from /lib/tls/libc.so.6 
#3  0x08091517 in xmalloc () 
#4  0x080a4291 in readline_internal_teardown () 
#5  0x080a4588 in readline_internal_char () 
#6  0x08083480 in termination_unwind_protect () 

Additional info:

Comment 1 Bastien Nocera 2005-01-24 14:21:49 UTC
*** Bug 145977 has been marked as a duplicate of this bug. ***

Comment 2 Tim Waugh 2005-01-27 13:00:18 UTC
I can't reproduce this from the description.  Could you attach the line that you
paste in please?

Comment 3 Tim Waugh 2005-02-07 11:30:16 UTC
*ping*

Comment 4 Tim Waugh 2005-02-28 10:48:08 UTC
I can't reproduce this from the description.  Could you attach the line that you
paste in please?


Note You need to log in before you can comment on or make changes to this bug.