Memory leak in bash 4.3

[Jean Delvare]

Hi all,

I have a bash script that runs as a daemon so it never exits, and its
memory consumption when run under bash 4.3.x (as reported as RSS by ps)
keeps increasing over time, apparently without any bound (starts at 3
MB and I've seen it reach 40 MB and still growing.) The memory
consumption of the same daemon script run under bash 4.2.x is steady. I
also tested a recent devel branch snapshot (bash-20150529) and
there is no memory increase there either. So the leak must have been
introduced during development between the 4.2 and 4.3 branches, and
fixed during development of between the 4.3 and upcoming 4.4 branches.

I would have bisected it, however I can't make much sense of the
branches in the git repository. Apparently snapshots are imported into
the devel branch from another source, so bisecting wouldn't lead to an
individual commit. Also I couldn't figure out which devel snapshots (if
any) correspond to versions 4.2.0 and 4.3.0 respectively so I don't
know where to start bisecting.

I built bash 4.3.39 with --without-bash-malloc and then ran the daemon
under valgrind for 1 minute. The back trace for the leak is:

3,973 bytes in 430 blocks are definitely lost in loss record 1,610 of 1,613
   at 0x4C277AB: malloc (in 
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
   by 0x471A2A: xmalloc (xmalloc.c:112)
   by 0x461A84: array_variable_name (arrayfunc.c:917)
   by 0x457731: parameter_brace_expand_word (subst.c:5785)
   by 0x452DA4: param_expand (subst.c:7385)
   by 0x4550E9: expand_word_internal (subst.c:8393)
   by 0x4566DB: call_expand_word_internal.constprop.14 (subst.c:3299)
   by 0x456829: expand_string_assignment (subst.c:3387)
   by 0x4509DB: expand_string_if_necessary (subst.c:3092)
   by 0x450E3E: do_assignment_internal (subst.c:2823)
   by 0x45859E: expand_word_list_internal (subst.c:2912)
   by 0x4360B7: execute_simple_command (execute_cmd.c:4000)

I do not have a minimum test case yet, but I wanted to ask if the back
trace above provides enough hints to recognize an already know bug and
the commit that fixed it?

Thanks,
-- 
Jean Delvare
SUSE L3 Support