Re: bash shell parser bug

[Stephane Chazelas]

On Thu, Mar 16, 2006 at 08:28:28PM -0800, laura fairhead wrote:
> 
> 
> Hello,

Hi Laura,

> I just found a bug that affects a number of shells (pressumably the
> code there is from the same roots) in the parser.
> 
> The following code;
> 
> l='eval "$l"'
> eval "$l"
> 
> Which sets off an infinite recursion on 'eval', should result in an 
> infinite loop to be terminated by INT (doesnt' work) or at least
> end gracefully with an error "bash: out of memory". Instead the
> system has to kill the shell process because of SEGV fault.
[...]

It's the same with

f() { f; }; f

actually.

~$ bash -c 'f() { f; }; f'
zsh: segmentation fault  bash -c 'f() { f; }; f'
(139)~$ zsh -c 'f() { f; }; f'
zsh: segmentation fault  zsh -c 'f() { f; }; f'
(139)~$ ksh -c 'f() { f; }; f'
zsh: segmentation fault  ksh -c 'f() { f; }; f'
(139)~$ ash -c 'f() { f; }; f'
zsh: segmentation fault  ash -c 'f() { f; }; f'
(139)~$ gawk 'function f() { f() } BEGIN { f() }'
zsh: segmentation fault  awk 'function f() { f() } BEGIN { f() }'
(139)~$ perl -le 'sub f { f(); }; f'
zsh: killed     perl -le 'sub f { f(); }; f'
(137)~$

For perl, it was probably the OOM killer, my Xserver was killed as well.


TCL:

~$ expect -c 'proc f {} { f }; f' 2>&1 | tail
"f "
    (procedure "f" line 1)
    invoked from within
"f "
    (procedure "f" line 1)
    invoked from within
"f "
    (procedure "f" line 1)
    invoked from within
"f"

The recursion limit seems to be 1000, there.

Same for:

expect -c 'set f {eval $f}; eval $f'

Same thing in python (limit 1000 as well) and ruby (limit seems higher).

~$ perl -le '$f = "eval \$f"; eval $f'

is still running but is slowly grabbing all the memory.

-- 
Stéphane