Re: bash shell parser bug

[Chet Ramey]

laura fairhead wrote:

> I just found a bug that affects a number of shells (pressumably the
> code there is from the same roots) in the parser.
> 
> The following code;
> 
> l='eval "$l"'
> eval "$l"
> 
> Which sets off an infinite recursion on 'eval', should result in an 
> infinite loop to be terminated by INT (doesnt' work) or at least
> end gracefully with an error "bash: out of memory". Instead the
> system has to kill the shell process because of SEGV fault.

I'm not sure why you are unable to kill the loop with SIGINT; I was
able to do it on the systems I tried.

You assume incorrectly that the code in the parser is at fault, and
that it is "from the same roots".  The infinite loop will eventually
cause the stack size (most common) or data size (less common) resource
limit to be exceeded, and cause the shell to be killed by the kernel.

Playing with resource limits (setting the data size limit low enough
and the stack size limit high enough), I was able to get malloc to
fail and observe the behavior, which was bash exiting with an error
message from xmalloc about an allocation failure.

Chet
-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
( ``Discere est Dolere'' -- chet )
                                           Live Strong.  No day but today.
Chet Ramey, ITS, CWRU    chet@case.edu    http://cnswww.cns.cwru.edu/~chet/