Crash in hashlib.c

[Bernd Eggink]

Version: GNU bash, Version 4.0.17(1)-release (i686-pc-linux-gnu)
(plus newline-shellmeta patch).

A script which uses, among other things, 3 associative arrays and a 
coprocess, crashes reproducibly with an allocation error:

   malloc: hashlib.c:306: assertion botched
   free: called with unallocated block argument
   Abbruch...
   Program received signal SIGABRT, Aborted.
   0xffffe424 in __kernel_vsyscall ()

Appended is a stack trace. Hope it helps.

Regards,
Bernd

--
Bernd Eggink
http://sudrala.de

malloc: hashlib.c:306: assertion botched
free: called with unallocated block argument
Abbruch...
Program received signal SIGABRT, Aborted.
0xffffe424 in __kernel_vsyscall ()
(gdb) bt
#0  0xffffe424 in __kernel_vsyscall ()
#1  0xb7dc9580 in raise () from /lib/libc.so.6
#2  0xb7dcadb8 in abort () from /lib/libc.so.6
#3  0x08081727 in programming_error (format=0x8117f50 "free: called with 
unallocated block argument") at error.c:175
#4  0x080fc81b in xbotch (mem=0x8101558, e=2, s=0x8117f50 "free: called with 
unallocated block argument", file=0x81027af "hashlib.c", 
    line=306) at malloc.c:319
#5  0x080fd347 in internal_free (mem=0x8101558, file=0x81027af "hashlib.c", 
line=306, flags=1) at malloc.c:876
#6  0x080fdb7f in sh_free (mem=0x8101558, file=0x81027af "hashlib.c", line=306) 
at malloc.c:1202
#7  0x080b841e in sh_xfree (string=0x8101558, file=0x81027af "hashlib.c", 
line=306) at xmalloc.c:190
#8  0x0809be16 in hash_flush (table=0x81c7f28, free_data=0) at hashlib.c:306
#9  0x080a703b in assoc_dispose (hash=0x81c7f28) at assoc.c:57
#10 0x0807d8a0 in dispose_variable_value (var=0x81c7a48) at variables.c:2584
#11 0x0807d8f6 in dispose_variable (var=0x81c7a48) at variables.c:2598
#12 0x0807f890 in push_func_var (data=0x81c7a48) at variables.c:3781
#13 0x0809bdd8 in hash_flush (table=0x81c7c28, free_data=0x807f7b8 
<push_func_var>) at hashlib.c:303
#14 0x0807f904 in pop_var_context () at variables.c:3803
#15 0x0807fbc1 in pop_context () at variables.c:3938
#16 0x0809f43b in unwind_frame_run_internal (tag=0x810114f "function_calling", 
ignore=0x0) at unwind_prot.c:291
#17 0x0809f0d2 in without_interrupts (function=0x809f39d 
<unwind_frame_run_internal>, arg1=0x810114f "function_calling", arg2=0x0)
    at unwind_prot.c:106
#18 0x0809f14f in run_unwind_frame (tag=0x810114f "function_calling") at 
unwind_prot.c:134
#19 0x08078a89 in execute_function (var=0x815b0c8, words=0x8168f28, flags=0, 
fds_to_close=0x8166968, async=0, subshell=0)
    at execute_cmd.c:4078
#20 0x08078ef2 in execute_builtin_or_function (words=0x8168f28, builtin=0, 
var=0x815b0c8, redirects=0x0, fds_to_close=0x8166968, flags=0)
    at execute_cmd.c:4271
#21 0x08077ffc in execute_simple_command (simple_command=0x818fc68, pipe_in=-1, 
pipe_out=-1, async=0, fds_to_close=0x8166968)
    at execute_cmd.c:3724
#22 0x08072ed9 in execute_command_internal (command=0x818fd68, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x8166968)
    at execute_cmd.c:724
#23 0x08075280 in execute_connection (command=0x818ec68, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x8166968)
    at execute_cmd.c:2173
#24 0x08073216 in execute_command_internal (command=0x818ec68, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x8166968)
    at execute_cmd.c:880
#25 0x080731e7 in execute_command_internal (command=0x81a7a08, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x8166968)
    at execute_cmd.c:872
#26 0x08078a47 in execute_function (var=0x815a488, words=0x8168d28, flags=0, 
fds_to_close=0x8166968, async=0, subshell=0)
    at execute_cmd.c:4056
#27 0x08078ef2 in execute_builtin_or_function (words=0x8168d28, builtin=0, 
var=0x815a488, redirects=0x0, fds_to_close=0x8166968, flags=0)
    at execute_cmd.c:4271
#28 0x08077ffc in execute_simple_command (simple_command=0x81665a8, pipe_in=-1, 
pipe_out=-1, async=0, fds_to_close=0x8166968)
    at execute_cmd.c:3724
#29 0x08072ed9 in execute_command_internal (command=0x8166588, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x8166968)
    at execute_cmd.c:724
#30 0x080726bb in execute_command (command=0x8166588) at execute_cmd.c:369
#31 0x08076cc5 in execute_if_command (if_command=0x81664a8) at 
execute_cmd.c:3067
#32 0x0807313d in execute_command_internal (command=0x8166488, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x8159688)
    at execute_cmd.c:832
#33 0x08075280 in execute_connection (command=0x8154608, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x8159688)
    at execute_cmd.c:2173
#34 0x08073216 in execute_command_internal (command=0x8154608, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x8159688)
    at execute_cmd.c:880
#35 0x080731e7 in execute_command_internal (command=0x8159a48, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x8159688)
    at execute_cmd.c:872
#36 0x08078a47 in execute_function (var=0x8159c08, words=0x8164268, flags=0, 
fds_to_close=0x8159688, async=0, subshell=0)
    at execute_cmd.c:4056
#37 0x08078ef2 in execute_builtin_or_function (words=0x8164268, builtin=0, 
var=0x8159c08, redirects=0x0, fds_to_close=0x8159688, flags=0)
    at execute_cmd.c:4271
#38 0x08077ffc in execute_simple_command (simple_command=0x81596a8, pipe_in=-1, 
pipe_out=-1, async=0, fds_to_close=0x8159688)
    at execute_cmd.c:3724
#39 0x08072ed9 in execute_command_internal (command=0x81517e8, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x8159688)
    at execute_cmd.c:724
#40 0x080726bb in execute_command (command=0x81517e8) at execute_cmd.c:369
#41 0x08061385 in reader_loop () at eval.c:152
#42 0x0805f177 in main (argc=3, argv=0xbfa50fd4, env=0xbfa50fe4) at shell.c:741