Memory leak within read builtin in both bash 4.0.x and 3.[12].x

[werner]

Configuration Information [Automatically generated, do not change]:
Machine: i586
OS: linux-gnu
Compiler: gcc -I/usr/src/packages/BUILD/bash-4.0 
-L/usr/src/packages/BUILD/bash-4.0/../readline-6.0
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='i586' 
-DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='i586-suse-linux-gnu' 
-DCONF_VENDOR='suse' -DLOCALEDIR='/usr/share/locale' -DPACKAGE='bash' -DSHELL 
-DHAVE_CONFIG_H   -I.  -I. -I./include -I./lib   -O2 -march=i586 -mtune=i686 
-fmessage-length=0 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -funwind-tables 
-fasynchronous-unwind-tables -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 
-D_GNU_SOURCE -DRECYCLES_PIDS -Wall -g -std=gnu89 -Wextra 
-Wno-unprototyped-calls -Wno-switch-enum -Wno-unused-variable 
-Wno-unused-parameter -ftree-loop-linear -pipe -fprofile-use
uname output: Linux boole 2.6.27.19-3.2-pae #1 SMP 2009-02-25 15:40:44 +0100 
i686 i686 i386 GNU/Linux
Machine Type: i586-suse-linux-gnu

Bash Version: 4.0
Patch Level: 24
Release Status: release

Description:
        A memory leak in read builtin in both bash 4.0.x and bash 3.[12].x

Repeat-By:
        Use the both scripts bug-510288_generator.sh and bug-510288_reader.sh
        to reproduce, start first bug-510288_reader.sh which creates fifo
        and read from this, then start bug-510288_generator.sh which generates
        the input for the first script.  Please note that the FILLDATA variable
        should be longer than 80 characters.

        bug-510288_reader.sh
-------------------------------------------------------------------------------------
#!/bin/bash
#
PIPE=/tmp/pipe
[ ! -e $PIPE ] || rm $PIPE || exit 1

mkfifo $PIPE

cleanup()
{
    rm $PIPE
    exit
}

trap cleanup EXIT INT

exec < $PIPE

lineno=0
oldstate=''
while true
do
    while read VAR1 VAR2 REST
    do
        let lineno=lineno+1
        state=$(egrep '^VmData|^VmRSS|^VmSize' </proc/$$/status)
        if [ "$state" != "$oldstate" -o "$VAR1" = 0 ]; then
            printf "LINE: %6d  " $lineno
            echo $state "VAR1='$VAR1' REST='$REST';
        fi
        oldstate="$state"
    done
done
-------------------------------------------------------------------------------------
        bug-510288_generator.sh 
-------------------------------------------------------------------------------------
#!/bin/bash
#
PIPE=/tmp/pipe
[ -e $PIPE ] || exit 1

FILLDATA='xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'

function sendlines() { local count=$1 line="$2"
    printf 'SENDING %5d times: %s\n' $count "$line"
    for (( i=0 ; ++i<=count ; 0 )); do
        echo "$line" >> $PIPE
    done
}

while true; do
    sendlines    1 "0 $FILLDATA"
    sendlines 1000 "1 $FILLDATA extraword1 extraword2"
    sendlines    1 "0 $FILLDATA"
    sendlines 1000 "2 $FILLDATA extraword1"
    sendlines    1 "0 $FILLDATA"
    sendlines 1000 "3 $FILLDATA"
    sendlines    1 "0 $FILLDATA"
done
-------------------------------------------------------------------------------------