Segmentation fault in arithmetical expression when mixing array variables.

[Eduardo A . Bustamante López]

Hi!

I found an issue while using array variables in an arithmetical
context. I tried to determine where the problem was, but I didn't
understand expr.c. The backtrace points to expr.c's line 556, in
expassing. I tested both the master and devel branches.


-------------------------------------------------------------------------------
Script
-------------------------------------------------------------------------------
#!/bin/bash

echo "$BASH_VERSION"
echo $(( a=(y[0] + y[1]) & 0xff, b=(y[2] + y[3]) & 0xff, a << 8 | b))
-------------------------------------------------------------------------------


-------------------------------------------------------------------------------
Results
-------------------------------------------------------------------------------
4.2.39(2)-release
bash: line 1: 30526 Segmentation fault      (core dumped) ~/bb/segfault 2>&1
-------------------------------------------------------------------------------
4.3.0(2)-devel
bash+: line 1: 30794 Segmentation fault      (core dumped) bash+ ~/bb/segfault 
2>&1
-------------------------------------------------------------------------------


-------------------------------------------------------------------------------
Backtrace
-------------------------------------------------------------------------------
Starting program: /home/dualbus/local/bin/bash+ ~/bb/segfault
warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7656251 in __strlen_sse2 () from /usr/lib/libc.so.6
#0  0x00007ffff7656251 in __strlen_sse2 () from /usr/lib/libc.so.6
#1  0x00000000004409c0 in expr_bind_array_element (tok=tok@entry=0x778338 "b", 
ind=ind@entry=1, rhs=rhs@entry=0x778348 "0")
    at expr.c:342
#2  0x00000000004422e4 in expassign () at expr.c:556
#3  0x00000000004414c2 in expcomma () at expr.c:453
#4  0x00000000004416d5 in subexpr (expr=0x7af988 " a=(y[0] + y[1]) & 0xff, 
b=(y[2] + y[3]) & 0xff, a << 8 | b") at expr.c:431
#5  subexpr (expr=0x7af988 " a=(y[0] + y[1]) & 0xff, b=(y[2] + y[3]) & 0xff, a 
<< 8 | b") at expr.c:407
#6  0x000000000044262a in evalexp (expr=expr@entry=0x7af988 " a=(y[0] + y[1]) & 
0xff, b=(y[2] + y[3]) & 0xff, a << 8 | b", 
    validp=validp@entry=0x7fffffffdb2c) at expr.c:396
#7  0x0000000000453f02 in param_expand (
    string=string@entry=0x7af588 "$(( a=(y[0] + y[1]) & 0xff, b=(y[2] + y[3]) & 
0xff, a << 8 | b))", 
    sindex=sindex@entry=0x7fffffffdc0c, quoted=quoted@entry=0, 
expanded_something=expanded_something@entry=0x7fffffffdcc8, 
    contains_dollar_at=contains_dollar_at@entry=0x7fffffffdc18, 
quoted_dollar_at_p=quoted_dollar_at_p@entry=0x7fffffffdc10, 
    had_quoted_null_p=had_quoted_null_p@entry=0x7fffffffdc14, pflags=0) at 
subst.c:7830
#8  0x0000000000454faa in expand_word_internal (word=0x7acf88, 
quoted=quoted@entry=0, isexp=isexp@entry=0, 
    contains_dollar_at=contains_dollar_at@entry=0x7fffffffdccc, 
expanded_something=expanded_something@entry=0x7fffffffdcc8)
    at subst.c:8272
#9  0x00000000004572dc in shell_expand_word_list (tlist=0x7af0c8, 
eflags=<optimized out>) at subst.c:9407
#10 expand_word_list_internal (list=<optimized out>, eflags=eflags@entry=31) at 
subst.c:9526
#11 0x0000000000457b9a in expand_words (list=<optimized out>) at subst.c:9126
#12 0x0000000000433bbe in execute_simple_command (simple_command=<optimized 
out>, pipe_in=pipe_in@entry=-1, 
    pipe_out=pipe_out@entry=-1, async=async@entry=0, 
fds_to_close=fds_to_close@entry=0x7782f8) at execute_cmd.c:3960
#13 0x00000000004359f0 in execute_command_internal 
(command=command@entry=0x7acfc8, asynchronous=asynchronous@entry=0, 
    pipe_in=pipe_in@entry=-1, pipe_out=pipe_out@entry=-1, 
fds_to_close=fds_to_close@entry=0x7782f8) at execute_cmd.c:780
#14 0x0000000000438e1e in execute_command (command=0x7acfc8) at 
execute_cmd.c:390
#15 0x000000000042105d in reader_loop () at eval.c:160
#16 0x000000000041f591 in main (argc=2, argv=0x7fffffffe138, 
env=0x7fffffffe150) at shell.c:755
-------------------------------------------------------------------------------



In case my O/S and hardware are relevant:

$ uname -a
Linux claret 3.6.9-1-ARCH #1 SMP PREEMPT Tue Dec 4 08:04:10 CET 2012 x86_64 
GNU/Linux

$ lscpu
Architecture:          x86_64
CPU op-mode(s):        32-bit, 64-bit
Byte Order:            Little Endian
CPU(s):                2
On-line CPU(s) list:   0,1
Thread(s) per core:    1
Core(s) per socket:    2
Socket(s):             1
NUMA node(s):          1
Vendor ID:             GenuineIntel
CPU family:            6
Model:                 23
Stepping:              6
CPU MHz:               1600.000
BogoMIPS:              4801.95
Virtualization:        VT-x
L1d cache:             32K
L1i cache:             32K
L2 cache:              3072K
NUMA node0 CPU(s):     0,1

-- 
Eduardo A. Bustamante López