echo "${HOME#$*/}" segfaults

[David Rochberg]

Configuration Information [Automatically generated, do not change]:
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='x86_64'
-DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='x86_64-pc-linux-gnu'
-DCONF_VENDOR='pc' -DLOCALEDIR='/usr/share/locale' -DPACKAGE='bash'
-DSHELL -DHAVE_CONFIG_H   -I.  -I../bash -I../bash/include
-I../bash/lib   -g -O2 -Wall
Machine Type: x86_64-pc-linux-gnu

Bash Version: 4.1
Patch Level: 5
Release Status: release

Description:

    echo "${HOME#$*/}" segfaults

    Here's a stack trace from a -g -O0 build of bash 4.1

      $ echo "${HOME#$*/}"

      Program received signal SIGSEGV, Segmentation fault.
      0x0000000000454ef1 in quote_string (string=0x0) at subst.c:3490
      3490        if (*string == 0)
      (gdb) where
      #0  0x0000000000454ef1 in quote_string (string=0x0) at subst.c:3490
      #1  0x000000000045c85b in param_expand (string=0x715c68 "$*/",
sindex=0x7fffffffdb64, quoted=8, expanded_something=0x0,
contains_dollar_at=0x7fffffffdb54,
          quoted_dollar_at_p=0x7fffffffdb60,
had_quoted_null_p=0x7fffffffdb58, pflags=0) at subst.c:7228
      #2  0x000000000045d93d in expand_word_internal
(word=0x7fffffffdc10, quoted=8, isexp=1, contains_dollar_at=0x0,
expanded_something=0x0) at subst.c:7802
      #3  0x000000000045450b in call_expand_word_internal
(w=0x7fffffffdc10, q=8, i=1, c=0x0, e=0x0) at subst.c:3129
      #4  0x00000000004549fd in expand_string_for_rhs (string=0x715c68
"$*/", quoted=8, dollar_at_p=0x0, has_dollar_at=0x0) at subst.c:3315
      #5  0x000000000045694f in getpattern (value=0x715c68 "$*/",
quoted=1, expandpat=1) at subst.c:4277
      #6  0x0000000000456d41 in parameter_brace_remove_pattern
(varname=0x75f0a8 "HOME",
          value=0xa23388
"\001/\001h\001o\001m\001e\001/\001r\001o\001c\001h\001b\001e\001r\001g",
patstr=0x773f58 "$*/", rtype=35, quoted=1) at subst.c:4411
      #7  0x000000000045c298 in parameter_brace_expand
(string=0x757888 "${HOME#$*/}", indexp=0x7fffffffde6c, quoted=1,
pflags=0, quoted_dollar_atp=0x7fffffffdfa0,
          contains_dollar_at=0x7fffffffdf94) at subst.c:6990
      #8  0x000000000045c99f in param_expand (string=0x757888
"${HOME#$*/}", sindex=0x7fffffffdfa4, quoted=1,
expanded_something=0x0,
          contains_dollar_at=0x7fffffffdf94,
quoted_dollar_at_p=0x7fffffffdfa0, had_quoted_null_p=0x7fffffffdf98,
pflags=0) at subst.c:7314
      #9  0x000000000045d93d in expand_word_internal (word=0xa202a8,
quoted=1, isexp=0, contains_dollar_at=0x7fffffffe0d4,
expanded_something=0x0) at subst.c:7802
      #10 0x000000000045dfc5 in expand_word_internal (word=0xa8b948,
quoted=0, isexp=0, contains_dollar_at=0x7fffffffe168,
expanded_something=0x7fffffffe16c)
          at subst.c:7933
      #11 0x000000000045f725 in shell_expand_word_list
(tlist=0xa84f48, eflags=31) at subst.c:8893
      #12 0x000000000045f9df in expand_word_list_internal
(list=0x9eda48, eflags=31) at subst.c:9010
      #13 0x000000000045f04a in expand_words (list=0x9eda48) at subst.c:8632
      #14 0x000000000043ad49 in execute_simple_command
(simple_command=0x71fd88, pipe_in=-1, pipe_out=-1, async=0,
fds_to_close=0x764d08) at execute_cmd.c:3645
      #15 0x0000000000435a49 in execute_command_internal
(command=0xa23108, asynchronous=0, pipe_in=-1, pipe_out=-1,
fds_to_close=0x764d08) at execute_cmd.c:730
      #16 0x0000000000435221 in execute_command (command=0xa23108) at
execute_cmd.c:375
      #17 0x0000000000421d75 in reader_loop () at eval.c:152
      #18 0x000000000041fbed in main (argc=1, argv=0x7fffffffe4a8,
env=0x7fffffffe4b8) at shell.c:749