Bash crashes while handling very long string in parameter expansion

[Siteshwar Vashisht]

Configuration Information [Automatically generated, do not change]:
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='x86_64' 
-DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='x86_64-unknown-linux-gnu' 
-DCONF_VENDOR='unknown' -DLOCALEDIR='/usr/local/share/locale' -DPACKAGE='bash' 
-DSHELL -DHAVE_CONFIG_H -DDEBUG -DMALLOC_DEBUG -I.  -I. -I./include -I./lib   
-g -O2 -Wno-parentheses -Wno-format-security
uname output: Linux localhost.localdomain 4.7.0-0.rc7.git4.1.fc25.x86_64 #1 SMP 
Mon Jul 18 15:59:11 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
Machine Type: x86_64-unknown-linux-gnu

Bash Version: 4.4
Patch Level: 0
Release Status: rc2

Description:
        Bash crashes while handling very long string in parameter expansion.

Repeat-By:
        Configure bash to compile with '--with-bash-malloc=no' parameter and 
install it :

        > ./configure --with-bash-malloc=no

        Generate file with very long string by executing below commands :

        > for i in $(seq 0 1023); do echo -n .; done > data1k
        > for i in $(seq 0 1023); do cat data1k; done > data1m
        > for i in $(seq 0 1023); do cat data1m; done > data1g

        Script to reproduce the crash :

        > cat test.sh
        #!/bin/bash

        _INPUT_LOG_FILE=$1

        echo "Starting..."

        CMD="cat ${_INPUT_LOG_FILE}"
        OUT=`${CMD} 2>&1`

        echo "${CMD} completed..."

        echo "Command Output : ${CMD} ${OUT}" > /dev/null

        exit 1

        Execute the script :

                /usr/local/bin/bash test.sh data1g

        Result:
                Bash crashes with segmentation fault

-- 
--
Siteshwar Vashisht