bash segfault using "spew | while read" idiom

[mod+bashbug]

Configuration Information [Automatically generated, do not change]:
Machine: i386
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='i386' 
-DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='i386-pc-linux-gnu' 
-DCONF_VENDOR='pc' -DSHELL -DHAVE_CONFIG_H   -I.  
-I/home/doko/packages/bash/bash-2.05a 
-I/home/doko/packages/bash/bash-2.05a/include 
-I/home/doko/packages/bash/bash-2.05a/lib -g -O2
uname output: Linux shrapnel 2.4.18 #4 Sat Mar 23 13:42:15 EST 2002 i686 unknown
Machine Type: i386-pc-linux-gnu

Bash Version: 2.05a
Patch Level: 0
Release Status: release

Description:

-- System Information
Debian Release: 3.0
Kernel Version: Linux shrapnel 2.4.18 #4 Sat Mar 23 13:42:15 EST 2002 i686 
unknown

Versions of the packages bash depends on:
ii  base-files     3.0.2          Debian base system miscellaneous files
ii  libc6          2.2.5-4        GNU C Library: Shared libraries and Timezone
ii  libncurses5    5.2.20020112a- Shared libraries for terminal handling


I'm running a very current Debian "testing".
I can kill bash by standing in the root directory
and saying:

   find . -type f | while read f; do /bin/true $f ; done

...though it takes a while.


The parent bash said:

malloc: array.c:78: assertion botched
free: underflow detected; mh_nbytes out of range
last command: find . -type f | while read f; do /bin/true $f ; done
Stopping myself...

and the child bash (which I had attached GDB to) looked like this:

 Program received signal SIGABRT, Aborted.
 0x400497b1 in kill () from /lib/libc.so.6
 (gdb) where
 #0  0x400497b1 in kill () from /lib/libc.so.6
 #1  0x40049494 in raise () from /lib/libc.so.6
 #2  0x4004ac11 in abort () from /lib/libc.so.6
 #3  0x0806c27d in programming_error () at error.c:258
 #4  0x080acd69 in xbotch (mem=0x8229148, e=4,
     s=0x80c3020 "free: underflow detected; mh_nbytes out of range",
     file=0x80b1e19 "array.c", line=78) at malloc.c:286
 #5  0x080ad297 in internal_free (mem=0x8229148, file=0x80b1e19 "array.c",
     line=78, flags=1) at malloc.c:759
 #6  0x080ad6ee in sh_free (mem=0x8229148, file=0x80b1e19 "array.c", line=78)
     at malloc.c:1006
 #7  0x08088a1c in sh_xfree (string=0x8229148, file=0x80b1e19 "array.c",
     line=78) at xmalloc.c:189
 #8  0x0807dee1 in destroy_array_element (ae=0x80d78a8) at array.c:78
 #9  0x0807df7c in empty_array (a=0x80d7868) at array.c:108
 #10 0x0806b976 in set_pipestatus_array (ps=0x80c4764) at variables.c:3276
 #11 0x0806b9cb in set_pipestatus_from_exit (s=0) at variables.c:3293
 #12 0x08066de1 in execute_simple_command (simple_command=0x80faa28,
     pipe_in=-1, pipe_out=-1, async=0, fds_to_close=0x80fb188)
     at execute_cmd.c:2721
 #13 0x0806434e in execute_command_internal (command=0x80fadc8, asynchronous=0,
     pipe_in=-1, pipe_out=-1, fds_to_close=0x80fb188) at execute_cmd.c:623
 #14 0x08063e07 in execute_command (command=0x80fadc8) at execute_cmd.c:317
 #15 0x0806613b in execute_while_or_until (while_command=0x80faf28, type=0)
     at execute_cmd.c:2139
 #16 0x080660e3 in execute_while_command (while_command=0x80faf28)
     at execute_cmd.c:2107
 #17 0x080644d5 in execute_command_internal (command=0x80faf48, asynchronous=0,
     pipe_in=-1, pipe_out=-1, fds_to_close=0x80fb048) at execute_cmd.c:725
 #18 0x08064f8d in execute_in_subshell (command=0x80faf48, asynchronous=0,
     pipe_in=5, pipe_out=-1, fds_to_close=0x80fb048) at execute_cmd.c:1257
 #19 0x08064061 in execute_command_internal (command=0x80faf48, asynchronous=0,
     pipe_in=5, pipe_out=-1, fds_to_close=0x80fb048) at execute_cmd.c:502
 #20 0x08065229 in execute_pipeline (command=0x80fafa8, asynchronous=0,
     pipe_in=-1, pipe_out=-1, fds_to_close=0x80fb048) at execute_cmd.c:1377
 #21 0x080653e9 in execute_connection (command=0x80fafa8, asynchronous=0,
     pipe_in=-1, pipe_out=-1, fds_to_close=0x80fb048) at execute_cmd.c:1488
 #22 0x0806458e in execute_command_internal (command=0x80fafa8, asynchronous=0,
     pipe_in=-1, pipe_out=-1, fds_to_close=0x80fb048) at execute_cmd.c:785
 #23 0x08063e07 in execute_command (command=0x80fafa8) at execute_cmd.c:317
 #24 0x0805b3b0 in reader_loop () at eval.c:139
 #25 0x08059a37 in main (argc=1, argv=0xbffff674, env=0xbffff67c) at shell.c:668
 #26 0x4003917f in __libc_start_main () from /lib/libc.so.6


Repeat-By:
        See above