Re: v4.4 segfault in 'decode_prompt_string' when processing special parameter
Thanks for taking the time to explain that :) I'll do more homework next
time
On Sat, Jul 21, 2018, 8:51 PM Chet Ramey wrote:
> On 7/21/18 9:16 PM, Chris Schoenberg wrote:
> > Fair enough. Even though the behavior is different, the end is the same
> as
> > udf so makes sense of you want to leave it. Weird how it popped up in 4.4
> > though.
>
> The ${param@op} expansions were introduced in bash-4.4.
>
> --
> ``The lyf so short, the craft so long to lerne.'' - Chaucer
> ``Ars longa, vita brevis'' - Hippocrates
> Chet Ramey, UTech, CWRUc...@case.eduhttp://tiswww.cwru.edu/~chet/
>
Re: v4.4 segfault in 'decode_prompt_string' when processing special parameter
On 7/21/18 9:16 PM, Chris Schoenberg wrote:
> Fair enough. Even though the behavior is different, the end is the same as
> udf so makes sense of you want to leave it. Weird how it popped up in 4.4
> though.
The ${param@op} expansions were introduced in bash-4.4.
--
``The lyf so short, the craft so long to lerne.'' - Chaucer
``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, UTech, CWRUc...@case.eduhttp://tiswww.cwru.edu/~chet/
Re: v4.4 segfault in 'decode_prompt_string' when processing special parameter
Fair enough. Even though the behavior is different, the end is the same as
udf so makes sense of you want to leave it. Weird how it popped up in 4.4
though.
On Sat, Jul 21, 2018, 6:58 PM Chet Ramey wrote:
> On 7/21/18 2:47 PM, Chris Schoenberg wrote:
> > This only works in 4.4; earlier versions throw a 'bad substitution'
> error. It
> > causes an infinite loop of calls between 'expand_prompt_string' and
> > 'decode_prompt_string',
> > where calls to 'xmalloc' exhaust the heap:
> >
> > $\{_@P};${_@P}
> >
> > I decided to report this because it is not a user-defined recursive
> > function and it exhausts the heap rather than the stack.
>
> It's user-defined recursive parameter expansion. A string that undergoes
> prompt expansion performs parameter expansion, as documented. If that
> parameter expansion passes the same string to prompt expansion, which
> performs parameter expansion, you've got user-defined recursion.
>
> --
> ``The lyf so short, the craft so long to lerne.'' - Chaucer
> ``Ars longa, vita brevis'' - Hippocrates
> Chet Ramey, UTech, CWRUc...@case.eduhttp://tiswww.cwru.edu/~chet/
>
Re: v4.4 segfault in 'decode_prompt_string' when processing special parameter
On 7/21/18 2:47 PM, Chris Schoenberg wrote:
> This only works in 4.4; earlier versions throw a 'bad substitution' error. It
> causes an infinite loop of calls between 'expand_prompt_string' and
> 'decode_prompt_string',
> where calls to 'xmalloc' exhaust the heap:
>
> $\{_@P};${_@P}
>
> I decided to report this because it is not a user-defined recursive
> function and it exhausts the heap rather than the stack.
It's user-defined recursive parameter expansion. A string that undergoes
prompt expansion performs parameter expansion, as documented. If that
parameter expansion passes the same string to prompt expansion, which
performs parameter expansion, you've got user-defined recursion.
--
``The lyf so short, the craft so long to lerne.'' - Chaucer
``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, UTech, CWRUc...@case.eduhttp://tiswww.cwru.edu/~chet/
Re: v4.4 segfault in 'decode_prompt_string' when processing special parameter
The payload got filtered, so here it is again (substitute the actual
character for [at]):
$\{_[at]P};${_[at]P}
On Sat, Jul 21, 2018, 1:47 PM Chris Schoenberg wrote:
> This only works in 4.4; earlier versions throw a 'bad substitution' error. It
> causes an infinite loop of calls between 'expand_prompt_string' and
> 'decode_prompt_string',
> where calls to 'xmalloc' exhaust the heap:
>
...
>
