See https://bugzilla.redhat.com/show_bug.cgi?id=1983015 for original issue.

I get following warning when I ran the reproducer through valgrind:

```
$ valgrind --track-origins=yes bash match.sh
...
==47424== For lists of detected and suppressed errors, rerun with: -s
==47424== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
==47423== Conditional jump or move depends on uninitialised value(s)
==47423==    at 0x490758C: utf8_internal_loop (loop.c:336)
==47423==    by 0x490758C: __gconv_transform_utf8_internal (skeleton.c:620)
==47423==    by 0x4972167: mbrtowc (mbrtowc.c:86)
==47423==    by 0x458C4F: read_comsub (subst.c:6243)
==47423==    by 0x458C4F: command_substitute (subst.c:6544)
==47423==    by 0x45ABCB: param_expand (subst.c:9860)
==47423==    by 0x45D497: expand_word_internal (subst.c:10326)
==47423==    by 0x45E163: expand_word_internal (subst.c:10510)
==47423==    by 0x45FB1F: call_expand_word_internal (subst.c:3732)
==47423==    by 0x45FB1F: expand_word_leave_quoted (subst.c:4056)
==47423==    by 0x438033: execute_case_command (execute_cmd.c:3541)
==47423==    by 0x438033: execute_command_internal (execute_cmd.c:954)
==47423==    by 0x43A883: execute_command (execute_cmd.c:395)
==47423==    by 0x423797: reader_loop (eval.c:170)
==47423==    by 0x421EEF: main (shell.c:811)
==47423==  Uninitialised value was created by a stack allocation
==47423==    at 0x458730: command_substitute (subst.c:6306)
...
```

I have tried to patch bash through following patch:

```
diff --git a/subst.c b/subst.c
index 462752de..d80cc3f1 100644
--- a/subst.c
+++ b/subst.c
@@ -6304,11 +6304,11 @@ command_substitute (string, quoted, flags)
      int quoted;
      int flags;
 {
-  pid_t pid, old_pid, old_pipeline_pgrp, old_async_pid;
-  char *istring, *s;
-  int result, fildes[2], function_value, pflags, rc, tflag, fork_flags;
-  WORD_DESC *ret;
-  sigset_t set, oset;
+  pid_t pid=0, old_pid=0, old_pipeline_pgrp=0, old_async_pid=0;
+  char *istring=0, *s=0;
+  int result=0, fildes[2]={}, function_value=0, pflags=0, rc=0, tflag=0, fork_flags=0;
+  WORD_DESC *ret=0;
+  sigset_t set={}, oset={};
 
   istring = (char *)NULL;
``` 

But I still keep getting the same warning. Can someone from glibc team look into it and help me find the root cause? This bug disappears when I try to reproduce it after recompiling bash. So it's possible it may be a bug in bash, but I have not been able to track it's root yet.

I think this is a bash bug. bufn+1 should be bufn:

	  /* read a multibyte character from buf */
	  /* punt on the hard case for now */
	  memset (&ps, '\0', sizeof (mbstate_t));
	  mblen = mbrtowc (&wc, bufp-1, bufn+1, &ps);

The reason is that bufp is advanced (“c = *bufp++;”), but not bufn is not decremented, so it has still the old value (4 in this case). zread has only written 4 bytes, so passing 5 to mbrtowc is wrong.

Reassigning back to bash on based on comment 3.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (bash bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:8403