null pointer in make_bare_word at make_cmd.c:90

[Al Elgert]

Configuration Information [Automatically generated, do not change]:
Machine: i686
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='i686' 
-DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='i686-pc-linux-gnu' 
-DCONF_VENDOR='pc' -DLOCALEDIR='/tmp/LX/6/share/locale' -DPACKAGE='bash' 
-DSHELL -DHAVE_CONFIG_H  -I.  -I. -I./include -I./lib   -g
uname output: Linux helix1 2.4.20-8 #1 Thu Mar 13 17:18:24 EST 2003 i686 athlon 
i386 GNU/Linux
Machine Type: i686-pc-linux-gnu

Bash Version: 3.0
Patch Level: 0
Release Status: release

Description:
        GNU bash, version 3.00.0(1)-release (i686-pc-linux-gnu)
        (and
        GNU bash, version 2.05b.0(1)-release (i386-redhat-linux-gnu)

        dumps a core because of a null pointer "in make_bare_word 
        at make_cmd.c:90" (see gdb output below)

Repeat-By:

        Consider this trimmed down function

        $ type run__bug
        run__bug is a function
        run__bug ()
        {
            local command;
            select command in "${command[@]}";
            do
                $FUNCNAME; # restarting function with new parameters ...
                return;
            done
        }
        $ run__bug
        1)
        #? e
        Segmentation fault (core dumped)

Fix:

$ gdb bash core.8547
GNU gdb Red Hat Linux (5.3post-0.20021129.18rh)
Copyright 2003 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux-gnu"...
Core was generated by `./bash'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /lib/libtermcap.so.2...done.
Loaded symbols for /lib/libtermcap.so.2
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/tls/libc.so.6...done.
Loaded symbols for /lib/tls/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from /lib/libnss_files.so.2...done.
Loaded symbols for /lib/libnss_files.so.2
#0  0x08067b59 in make_bare_word (string=0x0) at make_cmd.c:90
90        if (*string)
(gdb)
(gdb)
(gdb)
(gdb) bt
#0  0x08067b59 in make_bare_word (string=0x0) at make_cmd.c:90
#1  0x08067ce8 in make_word (string=0x0) at make_cmd.c:141
#2  0x080953fc in array_value_internal (s=0x86c3a68 "command[@]", quoted=1, 
allow_all=1, rtype=0xbfffd410) at arrayfunc.c:658
#3  0x0809558c in array_value (s=0x86c3a68 "command[@]", quoted=1, 
rtype=0xbfffd410) at arrayfunc.c:711
#4  0x080863df in parameter_brace_expand_word (name=0x86c3a68 "command[@]", 
var_is_special=0, quoted=1) at subst.c:4499
#5  0x08088be8 in parameter_brace_expand (string=0x8703848 "${command[@]}", 
indexp=0xbfffd52c, quoted=1, quoted_dollar_atp=0xbfffd5f0, 
contains_dollar_at=0xbfffd5e4)
    at subst.c:5596
#6  0x0808952e in param_expand (string=0x8703848 "${command[@]}", 
sindex=0xbfffd5f4, quoted=1, expanded_something=0x0, 
contains_dollar_at=0xbfffd5e4,
    quoted_dollar_at_p=0xbfffd5f0, had_quoted_null_p=0xbfffd5e8, pflags=0) at 
subst.c:5920
#7  0x08089e3a in expand_word_internal (word=0x8703648, quoted=1, isexp=0, 
contains_dollar_at=0xbfffd6a4, expanded_something=0x0) at subst.c:6260
#8  0x0808a30a in expand_word_internal (word=0x87039e8, quoted=0, isexp=0, 
contains_dollar_at=0xbfffd718, expanded_something=0xbfffd71c) at subst.c:6364
#9  0x0808b515 in shell_expand_word_list (tlist=0x86e0f88, eflags=30) at 
subst.c:7215
#10 0x0808b7b5 in expand_word_list_internal (list=0x86f2f28, eflags=30) at 
subst.c:7332
#11 0x0808afbe in expand_words_no_vars (list=0x86f2f28) at subst.c:6999
#12 0x0806df0d in execute_select_command (select_command=0x8702e28) at 
execute_cmd.c:2058
#13 0x0806bd62 in execute_command_internal (command=0x8702e48, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x86c3668) at execute_cmd.c:747
#14 0x0806d07d in execute_connection (command=0x87029a8, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x86c3668) at execute_cmd.c:1505
#15 0x0806bed7 in execute_command_internal (command=0x87029a8, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x86c3668) at execute_cmd.c:820
#16 0x0806beb5 in execute_command_internal (command=0x86dc388, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x86c3668) at execute_cmd.c:812
#17 0x08070017 in execute_function (var=0x86e6d48, words=0x86eb748, flags=0, 
fds_to_close=0x86c3668, async=0, subshell=0) at execute_cmd.c:3249
#18 0x080703a3 in execute_builtin_or_function (words=0x86eb748, builtin=0, 
var=0x86e6d48, redirects=0x0, fds_to_close=0x86c3668, flags=0) at 
execute_cmd.c:3437
#19 0x0806f6e5 in execute_simple_command (simple_command=0x86c35e8, pipe_in=-1, 
pipe_out=-1, async=0, fds_to_close=0x86c3668) at execute_cmd.c:2950
#20 0x0806bbe1 in execute_command_internal (command=0x86dc4a8, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x86c3668) at execute_cmd.c:660
#21 0x0806b5ce in execute_command (command=0x86dc4a8) at execute_cmd.c:347
#22 0x0806d04f in execute_connection (command=0x86ebcb8, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x86bebe8) at execute_cmd.c:1503
#23 0x0806bed7 in execute_command_internal (command=0x86ebcb8, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x86bebe8) at execute_cmd.c:820
#24 0x0806b5ce in execute_command (command=0x86ebcb8) at execute_cmd.c:347
#25 0x0806e0cb in execute_select_command (select_command=0x86b9cc8) at 
execute_cmd.c:2113
#26 0x0806bd62 in execute_command_internal (command=0x86eb388, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x86ebee8) at execute_cmd.c:747
#27 0x0806d07d in execute_connection (command=0x86dc6e8, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x86ebee8) at execute_cmd.c:1505
#28 0x0806bed7 in execute_command_internal (command=0x86dc6e8, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x86ebee8) at execute_cmd.c:820
#29 0x0806beb5 in execute_command_internal (command=0x86dc668, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x86ebee8) at execute_cmd.c:812
#30 0x08070017 in execute_function (var=0x86e6d48, words=0x86ec088, flags=0, 
fds_to_close=0x86ebee8, async=0, subshell=0) at execute_cmd.c:3249
#31 0x080703a3 in execute_builtin_or_function (words=0x86ec088, builtin=0, 
var=0x86e6d48, redirects=0x0, fds_to_close=0x86ebee8, flags=0) at 
execute_cmd.c:3437
#32 0x0806f6e5 in execute_simple_command (simple_command=0x86e06c8, pipe_in=-1, 
pipe_out=-1, async=0, fds_to_close=0x86ebee8) at execute_cmd.c:2950
#33 0x0806bbe1 in execute_command_internal (command=0x86e05c8, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x86ebee8) at execute_cmd.c:660
#34 0x0806b5ce in execute_command (command=0x86e05c8) at execute_cmd.c:347
#35 0x0805de20 in reader_loop () at eval.c:146
#36 0x0805bdea in main (argc=1, argv=0xbfffe094, env=0xbfffe09c) at shell.c:704
#37 0x42015574 in __libc_start_main () from /lib/tls/libc.so.6