bug-bash
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Bash crashes while handling very long string in parameter expansion


From: Chet Ramey
Subject: Re: Bash crashes while handling very long string in parameter expansion
Date: Wed, 10 Aug 2016 07:53:33 -0400
User-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.2.0

On 8/10/16 7:20 AM, Siteshwar Vashisht wrote:
>
> (gdb) frame 1
> #1  0x0000000000455a4a in sub_append_string (
>     source=0x7ffef75de010 
> "\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001.\001."...,
>  target=0x74aad0 "\001C\001o\001m\001m\001a\001n\001d\001 
> \001O\001u\001t\001p\001u\001t\001 :\001 \001c\001a\001t\001 
> \001d\001a\001t\001a\001\061\001g\001 ", 
>     indx=0x7fffffffdd30, size=0x7fffffffdd34) at subst.c:722
> 722           FASTCOPY (source, target + *indx, srclen);
> 
> 
> (gdb) l 713,722
> 713
> 714           srclen = STRLEN (source);
> 715           if (srclen >= (int)(*size - *indx))
> 716             {
> 717               n = srclen + *indx;
> 718               n = (n + DEFAULT_ARRAY_SIZE) - (n % DEFAULT_ARRAY_SIZE);
> 719               target = (char *)xrealloc (target, (*size = n));
> 720             }
> 721
> 722           FASTCOPY (source, target + *indx, srclen);
> 
> (gdb) p srclen
> $4 = -2147483648

Thanks, I'll take a look.

-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, UTech, CWRU    address@hidden    http://cnswww.cns.cwru.edu/~chet/



reply via email to

[Prev in Thread] Current Thread [Next in Thread]