[BUG] dash -c 'echo test > "${1%.in}"' sh /tmp/META.in segfaults on master
Kate Deplaix <[email protected]> Sat, 5 Apr 2025 22:05:21 +0000
| Newsgroups | org.kernel.vger.dash |
|---|---|
| Message-ID | <CWLP265MB4157446AD56C013BB88575CFBCA82@CWLP265MB4157.GBRP265.PROD.OUTLOOK.COM> |
Hi,
using dash master (currently b3e38adf6718801e7f06267b438c45caec9523bb), the following test case:
$ dash -c 'echo test > "${1%.in}"' sh /tmp/META.in
segfaults.
Launching it in a quick gdb, it appears that the segfault occurs in subevalvar (src/expand.c line 768).
This behaviour is consistently reproducible on different hardware owned by different people. The segfault disappears if the string doesn't contain any slashes (e.g. dash -c 'echo test > "${1%.in}"' sh META.in works fine).
Cheers,
Kate Deplaix