Crash on valid input

[Dan Kegel]

If I check for an empty string like this:

+ test ! $foo

dash crashes.  This occurs both in the version shipped with ubuntu
10.04 and 12.04
as well as with dash from git.

Here's the stack:

Program received signal SIGSEGV, Segmentation fault.
__strcmp_sse4_2 () at ../sysdeps/i386/i686/multiarch/strcmp-sse4.S:221
221 ../sysdeps/i386/i686/multiarch/strcmp-sse4.S: No such file or directory.
(gdb) bt
#0  __strcmp_sse4_2 () at ../sysdeps/i386/i686/multiarch/strcmp-sse4.S:221
#1  0x0805938a in getop (s=0x202b Address 0x202b out of bounds) at
bltin/test.c:168
#2  0x08059c91 in t_lex (tp=0x806581c) at bltin/test.c:431
#3  0x080595cb in aexpr (n=UNOT) at bltin/test.c:260
#4  0x08059557 in oexpr (n=UNOT) at bltin/test.c:243
#5  0x080594ba in testcmd (argc=1, argv=0x8065814) at bltin/test.c:219
#6  0x0804c526 in evalbltin (cmd=0x805da1c, argc=2, argv=0x8065810,
flags=0) at eval.c:910
#7  0x0804c383 in evalcommand (cmd=0x80657cc, flags=0) at eval.c:850
#8  0x0804b4ab in evaltree (n=0x80657cc, flags=0) at eval.c:280
#9  0x08052d72 in cmdloop (top=1) at main.c:238
#10 0x08052c76 in main (argc=2, argv=0xb944) at main.c:178
(gdb) frame 2
#2  0x08059c91 in t_lex (tp=0x806581c) at bltin/test.c:431
431 op = getop(s);
(gdb) print s
$1 = 0x202b Address 0x202b out of bounds

Thanks for dash!
--
To unsubscribe from this list: send the line unsubscribe dash in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: Crash on valid input

[Eric Blake]

On 04/08/2013 09:12 PM, Dan Kegel wrote:
 Yes, my script was crap, I've fixed it.
 
 Here's the reproducer.  Called with foo unset.  I think it doesn't
 crash without -x.
 
 #!/bin/dash
 set -x
 test ! $foo

The 'set -x' was indeed the key to reproducing the problem.  In fact,
this is the shortest I could make it:

dash -cx 'test !'

-- 
Eric Blake   eblake redhat com+1-919-301-3266
Libvirt virtualization library http://libvirt.org



signature.asc
Description: OpenPGP digital signature