loadable cut builtin gives assertion botched in free()

Duncan Roe <[email protected]> Mon, 16 Mar 2026 16:41:59 +1100

Newsgroups	gmane.comp.shells.bash.bugs
Message-ID	<[email protected]>

Hi Chet,

Bash version: devel tip (or any other branch tip)
Sample:-
| 16:17:12$ echo A=BB| cut -f1 -d' ' | cut -f2 -d=
| BB
| 16:17:38$ enable cut
| 16:17:46$ echo A=BB| cut -f1 -d' ' | cut -f2 -d=
| BB
| 
| malloc: cut.c:342: assertion botched
| free: start and end chunk sizes differ
| last command: echo A=BB| cut -f1 -d' ' | cut -f2 -d=
| Aborting...Aborted                    (core dumped) echo A=BB | cut -f1 -d' ' | cut -f2 -d=
| 16:17:49$ rm core

Patch appended,

Cheers ... Duncan.

cut.patch (text/plain, 698 B)

diff --git a/examples/loadables/cut.c b/examples/loadables/cut.c
index 20793ab3..c45c3575 100644
--- a/examples/loadables/cut.c
+++ b/examples/loadables/cut.c
@@ -263,6 +263,8 @@ cutfields (SHELL_VAR *v, arrayind_t ind, char *line, struct cutop *ops)
   size_t llen, fsize;
   int i, b, n, s, e, nf;
 
+  llen = strlen(line);	/* Before line gets clobbered by strsep() */
+
   delim[0] = ops->delim;
   delim[1] = '\0';
 
@@ -318,7 +320,7 @@ cutfields (SHELL_VAR *v, arrayind_t ind, char *line, struct cutop *ops)
     }
 
   /* build the string and assign or print it all at once */
-  buf = xmalloc (strlen (line) + 1);
+  buf = xmalloc (llen + 1);
 
   for (i = 1, n = b = 0; b < nf; b++)
     {