[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Some segfaults possible via mapfile callbacks

From: Dan Douglas
Subject: Some segfaults possible via mapfile callbacks
Date: Wed, 09 Jan 2013 12:49:18 -0600
User-agent: KMail/4.8.3 (Linux/3.4.6-pf+; KDE/4.8.3; x86_64; ; )

Hi. These were easy for me to reproduce in various versions.

Export to mapfile the variable to be assigned, then run any callback:
        $ printf '%s\n' {a..z} | bash -xc 'a= mapfile -tc1 -C : a'
        + a=
        + mapfile -tc1 -C : a
        ++ : 0 a
        Segmentation fault

Set any variable, then unset mapfile's variable. (takes a few iterations):
        $ printf '%s\n' {a..z} | bash -xc 'b=; mapfile -tc1 -C "unset -v a; :" 
        + b=
        + mapfile -tc1 -C 'unset -v a; :' a
        ++ unset -v a
        ++ : 0 a
        ++ unset -v a
        ++ : 1 b
        ++ unset -v a
        ++ : 2 c
        Segmentation fault

Or modify its type to anything but an indexed array for a faster failure:
        $ printf '%s\n' {a..z} | bash -xc 'b=; mapfile -tc1 -C "unset -v a; a=; 
:" a'
        + b=
        + mapfile -tc1 -C 'unset -v a; a=; :' a
        ++ unset -v a
        ++ a=
        ++ : 0 a
        Segmentation fault

Or indirectly via nameref:
        $ printf '%s\n' {a..z} | bash -xc 'typeset -n x=a; mapfile -tc1 -C 
"unset -v x; :" a'
        + typeset -n x=a
        + mapfile -tc1 -C 'unset -v x; :' a
        ++ unset -v x
        ++ : 0 a
        Segmentation fault

There were others, mostly to do with modifying the variable being mapped.
Dan Douglas

Attachment: signature.asc
Description: This is a digitally signed message part.

reply via email to

[Prev in Thread] Current Thread [Next in Thread]