[BUG] global-buffer-overflow umaskcmd() src/miscbltin.c:275

Dear Dash maintainers,

I encountered a bug in Dash in commit f8aaaa (Also the behaviour repeats on
0.5.13 version of Dash) and would like to report
it. The details are provided below.
=================================================================
==42==ERROR: AddressSanitizer: global-buffer-overflow on address
0x5cdb8a98b660 at pc 0x5cdb8a392400 bp 0x7ffe75d79670 sp 0x7ffe75d79668
READ of size 1 at 0x5cdb8a98b660 thread T0
    #0 0x5cdb8a3923ff in umaskcmd /upstream/dash/src/miscbltin.c:275
    #1 0x5cdb8a35619e in evalbltin /upstream/dash/src/eval.c:960
    #2 0x5cdb8a358ada in evalcommand /upstream/dash/src/eval.c:908
    #3 0x5cdb8a350ae0 in evaltree /upstream/dash/src/eval.c:299
    #4 0x5cdb8a38b35b in cmdloop /upstream/dash/src/main.c:242
    #5 0x5cdb8a2683ab in main /upstream/dash/src/main.c:176
    #6 0x797d9d6ed249 in __libc_start_call_main
../sysdeps/nptl/libc_start_call_main.h:58
    #7 0x797d9d6ed304 in __libc_start_main_impl ../csu/libc-start.c:360
    #8 0x5cdb8a269490 in _start (/upstream/dash/src/dash+0x1a490)

0x5cdb8a98b660 is located 0 bytes to the right of global variable
'stackbase' defined in 'memalloc.c:107:20' (0x5cdb8a98b460) of size 512
SUMMARY: AddressSanitizer: global-buffer-overflow
/upstream/dash/src/miscbltin.c:275 in umaskcmd

Shadow bytes around the buggy address:
  0x0b9bf1529670: 00 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
  0x0b9bf1529680: 04 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x0b9bf1529690: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0b9bf15296a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0b9bf15296b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0b9bf15296c0: 00 00 00 00 00 00 00 00 00 00 00 00[f9]f9 f9 f9
  0x0b9bf15296d0: 00 00 00 00 01 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
  0x0b9bf15296e0: 00 00 02 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9
  0x0b9bf15296f0: 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9
  0x0b9bf1529700: 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9
  0x0b9bf1529710: 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 04 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==42==ABORTING

////////////////
My environment:
////////////////

Debian-12, x86-64, clang-19 compiler

/////////////////
Steps to reproduce:
/////////////////

$ aclocal && autoheader && automake --add-missing && autoconf
$ CC=clang CFLAGS=" -Wno-everything -fsanitize=address -g -O0" ./configure
--disable-fnmatch --disable-lineno --disable-glob
$ make
$ cd src
$ ./dash < myfile.txt

//////////////////
Steps to get myfile.txt:
//////////////////

copy the text into file bs64.txt (between ==== and ======):
=====================================================================================
MTAwMAphCmVuZC0xCmEKZW5kLTIKYTp4CmVuZC1hCnUgbG9iOngKZW5kLWIKYzp4CmVuZC1jCmVu
ZC0zCmE6eAplbmQKYQpiCmMKZW5kLTEKYQpiCmMKZZFkLTIKYTp4CmE6eQphOnoKZW5kLWEKYjp4
CmI6eQpiOnoKZW5kLWIKYzp4c2V0CmVuYWJsZW5kLWMKZW5kLTMKYTp4+WI6eApjOngKZW5kCiRC
VkFSCiRCVkFSCiRCVkFSCiRCVkFSCmZvbwpiYXIKeHh4CjAwMjIKdT1yd3gsZz1yeCxvPXJ4CjAw
MDIKdT1yd3gsZz1yd3gsbz1yeAp1bWFzayAwMDAyCnVtYXNrIC1TIHU9cnd4LGcgZ29vZD1yIEZP
UiBBIFBBUlRJQ1VMQVIgUFVSUE9TRS4gIFNlZSB0aGUKIyAgIEdOVSBHZW5lcmFsIFB1YmxpYyBM
aWNlbnNlIGZvciBtb3JlIGRldGFpbHMuCiMKIyAgIFlvdSBzaG9hbmsgbGF2ZXd4LG89cngKdT1y
d3gsZz1yd3gsbz1yd3gKZW5hYmxlIC4KZW5hYmxlFToKZW5hYmxlIGsKZW5hYmxlZQpbbmFibGUg
ZXZhbAplbmFibGUgZXhlYwplbmFibGUgZXhpdAplbmFibGUgZXhwb3J0CmVuYWJsZSBybmx5CmVu
YWJsZSBybgplbmFibGUgdGV0CmVuYWJsZSB0CmVuYWJsZSBzb3VyY2UKZW5hYmxlIHQKZW5hYmxl
IHRyYXAKZW5ibGUgdW5zZXQKZW5hYmxlIC4KZW5hYmxlIDoKZW5hYmxlIGJyZWFrCmVuYWJsZSBj
b250aW51ZQplbmFibGUgZXZhbAplbmFibGUgZXhlYwplbmFibGUgZXhpdAplbmFibGUgZXhwb3J0
CmVuA+hsZSByZWFkb25seQplbmFibGUgcmV0dXJuCmVuYWJsZSBzZXQKZW5hYmxlIHNoaWZ0CmVu
YWJsZSBzb3VyYzs7IGVzYWMgO30KbWVzCmVuYWJsZSB0cmFwCmVuYWJsZSB1bnNldAplbmFibGUg
LW4gdGVzdCB3b3JrZWQKZW5hYmxlIHRlc3Qgd29ya2VkCnNwZWNpYWxuYW1lCi1zcGVjaQp1bWFz
ayAwMDAyCnVtYXNrIC1TIHU9cnd4LGcgYWxuYW1lCkZPQD1CQQoKc2V0IC1vIHBylomtCg==
=====================================================================================
Then do the action: base64 -d bs64.txt > myfile.txt
Or just take from attachments

1000
a
end-1
a
end-2
a:x
end-a
u lob:x
end-b
c:x
end-c
end-3
a:x
end
a
b
c
end-1
a
b
c
e租-2
a:x
a:y
a:z
end-a
b:x
b:y
b:z
end-b
c:xset
enablend-c
end-3
a:x:x
c:x
end
$BVAR
$BVAR
$BVAR
$BVAR
foo
bar
xxx
0022
u=rwx,g=rx,o=rx
0002
u=rwx,g=rwx,o=rx
umask 0002
umask -S u=rwx,g good=r FOR A PARTICULAR PURPOSE.  See the
#   GNU General Public License for more details.
#
#   You shoank lavewx,o=rx
u=rwx,g=rwx,o=rwx
enable .
enable:
enable k
enablee
[nable eval
enable exec
enable exit
enable export
enable rnly
enable rn
enable tet
enable t
enable source
enable t
enable trap
enble unset
enable .
enable :
enable break
enable continue
enable eval
enable exec
enable exit
enable export
en鑞e readonly
enable return
enable set
enable shift
enable sourc;; esac ;}
mes
enable trap
enable unset
enable -n test worked
enable test worked
specialname
-speci
umask 0002
umask -S u=rwx,g alname
FO@=BA

set -o pr哩ｭ