[bash] Variable-name parsing consumes first byte of following multibyte UTF-8 character

zheng <[email protected]>
Newsgroups gmane.comp.shells.bash.bugs
Message-ID <[email protected]>
# Bash bug report: variable-name parsing swallows first byte of multibyte UTF-8 char

## Summary
In a UTF-8 locale, `$VAR` immediately followed by a multibyte (non-ASCII)
character causes bash to treat the first byte of that character as part of the
variable name. Result:
- with `set -u`: `VAR<0xef>: unbound variable` (script aborts)
- without `set -u`: `$VAR` silently expands to empty (data loss, no error)

## Minimal repro (repro-minimal.sh)
```sh
set -u
V=xyz
echo "值 $V,尾"
```
Expected: `值 xyz,尾`
Actual (GNU bash 5.3.15, aarch64-apple-darwin, UTF-8 locale):
```
repro-minimal.sh: line 4: V�: unbound variable
```
Byte-level: the reported name is `V` + `0xEF` (first byte of U+FF0C FULLWIDTH
COMMA, UTF-8 `EF BC 8C`). Confirmed via `xxd`.

## Scope
Any multibyte UTF-8 character directly after `$VAR` triggers this, regardless
of lead byte: tested U+FF0C (ef), U+FF08 (ef), U+FF09 (ef), U+4E2D (e4),
U+2192 (e2), U+FF1A (ef), U+FF5E (ef), U+00B7 (e2) — all fail; ASCII `#`
after `$VAR` works fine.

## Environment
- GNU bash 3.2.57(1)-release (arm64-apple-darwin25) — macOS /bin/bash
- GNU bash 5.3.15(1)-release (aarch64-apple-darwin25.4.0) — Homebrew build
- Both fail in `en_US.UTF-8`; both work with `LC_ALL=C`

## Notes
- Workaround: use `${VAR}` braces (works correctly).
- Observed in the wild: multiple projects hit this (signet PR#29, autoagent
  commit 96e8cc6, nebula commit 555c688) and patched by brace-protecting
  variables adjacent to CJK text.
- Related upstream thread: "multibyte_identifiers" patch (bug-bash 2026-07)
  is about *allowing* multibyte identifiers; this report is about the
  *existing* parsing defect for adjacent multibyte chars.


## System
- uname: uname_result(system='Darwin', node='mzdeMacBook-Air.local', release='25.5.0', version='Darwin Kernel Version 25.5.0: Tue Jun  9 22:28:17 PDT 2026; root:xnu-12377.121.10~1/RELEASE_ARM64_T8142', machine='arm64')
- bash: 5.3.15(1)-release (aarch64-apple-darwin25.4.0) — Homebrew build; also reproduced on macOS system bash 3.2.57(1)-release
- locale: en_US.UTF-8 (LC_ALL unset); NOT reproduced with LC_ALL=C


## Repro script (repro-minimal.sh)
```sh
#!/usr/bin/env bash
# 最小复现:bash 变量名解析吞并多字节 UTF-8 首字节
# 环境:UTF-8 locale;复现于 GNU bash 3.2.57 (Apple build) 与 5.3.15
# 用法:bash repro-minimal.sh
set -u
V=xyz
echo "值 $V,尾"   # 期望: 值 xyz,尾  实际: V\xef: unbound variable (exit 1)

```

## Trigger matrix (repro-trigger-chars.sh)
All of the following suffixes after `$V` fail (variable value is silently lost
without `set -u`, or `V<lead-byte>: unbound variable` with `set -u`):
U+FF0C, U+FF08, U+FF09, U+4E2D, U+2192, U+FF1A, U+FF5E, U+00B7.
ASCII `#` after `$V` works correctly.

## Expected vs actual
```
$ bash repro-minimal.sh
Expected: 值 xyz,尾
Actual:   repro-minimal.sh: line 4: V�: unbound variable   (exit 1)
```
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.