bug-bash
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Segfault assigning to nameref with bad array subscript


From: Grisha Levit
Subject: Segfault assigning to nameref with bad array subscript
Date: Wed, 27 Apr 2016 02:45:43 -0400

Any of the following will crash bash:

declare -n ref=a[*]; ref=
declare -n ref=a[@]; ref=
declare -n ref=a[-1]; a=(); ref=

declare -A A; declare -n ref='A[$unset]'; ref=

They all produce "bad array subscript" errors so could be caught.

==60597== Invalid read of size 4
==60597==    at 0x100020BEE: bind_variable_internal (variables.c:2717)
==60597==    by 0x1000392E3: do_assignment_internal (subst.c:3121)
==60597==    by 0x10003F8D4: expand_word_list_internal (subst.c:3161)
==60597==    by 0x100019094: execute_command_internal (execute_cmd.c:4105)
==60597==    by 0x100017BF6: execute_command_internal (execute_cmd.c:2579)
==60597==    by 0x10006A82E: parse_and_execute (evalstring.c:417)
==60597==    by 0x1000032E7: run_one_command (in /Users/levit/utils/bin/bash)
==60597==    by 0x100002502: main (shell.c:724)
==60597==  Address 0x28 is not stack'd, malloc'd or (recently) free'd

reply via email to

[Prev in Thread] Current Thread [Next in Thread]