Re: Bash 5.3-devel getopts reads 1 byte past the end of a buffer when called twice

[Chet Ramey]

On 7/17/25 12:52 AM, Nathan Mills wrote:

Bash Version: 5.3-devel
Patch Level: 0
Release Status: devel-a23c863e

Clang:
```
clang version 19.1.7
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /nix/store/x6rsdc4s0f1j9bn1cx2h1l5fj8765ykw-clang-19.1.7/bin
```

NixOS:
```
nixos-version

25.05.806304.dfcd5b901dba (Warbler)

```

Description:
Running the following code causes AddressSanitizer to crash with a
heap buffer overflow. It seems that nextchar points one past the NUL
terminator on the 2nd getopts call. Probably because the 3rd argument
of the first call was one character longer. It seems that sh_charindex
does not get reset to zero between getopts invocations.

Technically this is undefined behavior. POSIX says the script needs to
reset OPTIND to 1 if you want to call getopts twice with a different set
of parameters.

I'll see how to detect this and restore state.

Chet

--
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, UTech, CWRU    c...@case.edu    http://tiswww.cwru.edu/~chet/

OpenPGP_signature.asc
Description: OpenPGP digital signature