export TERM can sometimes crash bash

[Zen Parse]

bug-bash@gnu.org

Configuration Information [Automatically generated, do not change]:
Machine: i386
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='i386'
-DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='i386-redhat-linux-gnu'
-DCONF_VENDOR='redhat' -DSHELL -DHAVE_CONFIG_H  -D_GNU_SOURCE
-D_FILE_OFFSET_BITS=64  -I.  -I. -I./include -I./lib -I/usr/include -O2
-march=i386 -mcpu=i686
uname output: Linux clarity 2.2.17-14 #1 Mon Feb 5 16:02:20 EST 2001
i686 unknown
Machine Type: i386-redhat-linux-gnu

Bash Version: 2.04
Patch Level: 11
Release Status: release

Description:
 bash drops core when u set an invalid TERM type, and change back to
xterm,
 sometimes not straight away, but eventually it will.

Repeat-By:

export TERM=../../
export TERM=xterm

eg:

[root@clarity /tmp]# bash
[root@clarity /tmp]# export TERM=../..
[root@clarity /tmp]# export TERM=/////////
[root@clarity /tmp]# export TERM=id
[root@clarity /tmp]# export TERM=xterm
[root@clarity /tmp]# export TERM=ps
free: called with already freed block argument
last command: export TERM=ps
Stopping myself...Aborted (core dumped)
[root@clarity /tmp]# gdb bash core
...
(Loading library stuff deleted)
...
(gdb) bt
#0  0x40053dd1 in __kill () from /lib/libc.so.6
#1  0x40053baa in raise (sig=6) at ../sysdeps/posix/raise.c:27
#2  0x40055352 in abort () at ../sysdeps/generic/abort.c:88
#3  0x806c084 in programming_error ()
#4  0x80a96bd in free ()
#5  0x80a3fe5 in _rl_init_terminal_io ()
#6  0x80a439f in rl_reset_terminal ()
#7  0x806b3a8 in stupidly_hack_special_variables ()
#8  0x8073334 in do_array_element_assignment ()
#9  0x80733b1 in do_assignment_no_expand ()
#10 0x80913d9 in set_or_show_attributes ()
#11 0x80911b3 in export_builtin ()
#12 0x8066dab in execute_command_internal ()
#13 0x806737f in execute_shell_function ()
#14 0x8066b73 in execute_command_internal ()
#15 0x80640a1 in execute_command_internal ()
#16 0x8063ab4 in execute_command ()
#17 0x805ae2b in reader_loop ()
#18 0x80594dc in main ()
#19 0x40042f31 in __libc_start_main (main=0x8058e30 <main>, argc=1,
    ubp_av=0xbffffa94, init=0x8058470 <_init>, fini=0x80aae4c <_fini>,
    rtld_fini=0x4000e274 <_dl_fini>, stack_end=0xbffffa8c)
    at ../sysdeps/generic/libc-start.c:129
(gdb)