Bug 683722 - ksh crashes when IFS is unset inside a function
Summary: ksh crashes when IFS is unset inside a function
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: ksh
Version: 5.5
Hardware: Unspecified
OS: Unspecified
urgent
high
Target Milestone: rc
: ---
Assignee: Michal Hlavinka
QA Contact: qe-baseos-tools
URL:
Whiteboard:
Depends On:
Blocks: 683734 684829 727223 727891
TreeView+ depends on / blocked
 
Reported: 2011-03-10 06:57 UTC by Siddhesh Poyarekar
Modified: 2018-11-14 14:05 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
The KornShell's "IFS" variable contains a list of field separators and is used to separate the results of command substitution, parameter expansion, or separate fields with the "read" built-in command. Previously, ksh did not protect this variable from being freed. Consequent to this, when a user attempted to unset the "IFS" variable from within a function, ksh terminated unexpectedly with a segmentation fault. With this update, an upstream patch has been applied to address this issue, and using the "unset IFS" command inside a function body no longer causes ksh to crash.
Clone Of:
: 683734 (view as bug list)
Environment:
Last Closed: 2012-02-21 05:50:33 UTC
Target Upstream Version:


Attachments (Terms of Use)
Ensure that IFS.nofree is set during init (709 bytes, patch)
2011-03-10 07:01 UTC, Siddhesh Poyarekar
no flags Details | Diff


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2012:0159 normal SHIPPED_LIVE ksh bug fix and enhancement update 2012-02-20 14:53:47 UTC

Description Siddhesh Poyarekar 2011-03-10 06:57:16 UTC
Description of problem:
ksh crashes when IFS is unset inside a function

Version-Release number of selected component (if applicable):
ksh-20100202-1.el5_6.3

How reproducible:
Always

Steps to Reproduce:
Execute the following script:

-----------------------
#!/bin/ksh

function crash
{
  typeset IFS
  unset IFS
  cd
  print "hello"
}

crash
-----------------------
  
Actual results:
segfault

Expected results:
hello

Additional info:
This has been fixed upstream in ksh-20101010 and later. Relevant mail thread:

https://mailman.research.att.com/pipermail/ast-developers/2010q4/000785.html

Comment 2 Siddhesh Poyarekar 2011-03-10 07:01:33 UTC
Created attachment 483373 [details]
Ensure that IFS.nofree is set during init

Comment 9 Miroslav Svoboda 2012-01-18 08:59:35 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
The KornShell's "IFS" variable contains a list of field separators and is used to separate the results of command substitution, parameter expansion, or separate fields with the "read" built-in command. Previously, ksh did not protect this variable from being freed. Consequent to this, when a user attempted to unset the "IFS" variable from within a function, ksh terminated unexpectedly with a segmentation fault. With this update, an upstream patch has been applied to address this issue, and using the "unset IFS" command inside a function body no longer causes ksh to crash.

Comment 10 errata-xmlrpc 2012-02-21 05:50:33 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0159.html


Note You need to log in before you can comment on or make changes to this bug.