ASan crash on failed eval with redirection in subshell

Op 27-07-2026 om 17:28 schreef Martijn Dekker:
> I've compiled dash (current master branch, commit 037bbdfd) on an M1 (arm64) 
> machine with macOS 15.7.4 with Apple's clang 17.0.0 and CFLAGS='-O0 -g - 
> fsanitize=address'.
> 
> Looks like there are multiple crashes when running the shellspec[*1] and 
> modernish[*2] regression tests. I will try to derive some concrete reproducers.


Here's another reproducer, derived from the modernish feature test for 
arithmetic for loops. The subshell, the eval and the redirection are all 
necessary to trigger the crash. It can be any redirection.

	(eval 'for ((;0;)) do :; done' 2>&2)

$ src/dash asan_crash.sh
asan_crash.sh: 1: eval: Syntax error: Bad for loop variable
AddressSanitizer: CHECK failed: asan_poisoning.cpp:40 "((AddrIsInMem(addr + 
size - (1ULL << 3)))) != (0)" (0x0, 0x0) (tid=16319841)
     #0 0x0001016031cc in __asan::CheckUnwind()+0x24 
(libclang_rt.asan_osx_dynamic.dylib:arm64e+0x471cc)
     #1 0x00010161d048 in __sanitizer::CheckFailed(char const*, int, char 
const*, unsigned long long, unsigned long long)+0x94 
(libclang_rt.asan_osx_dynamic.dylib:arm64e+0x61048)
     #2 0x000101641f34 in __asan::PoisonShadow(unsigned long, unsigned long, 
unsigned char) (.cold.4)+0x20 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x85f34)
     #3 0x0001015fafb0 in __asan::PoisonShadow(unsigned long, unsigned long, 
unsigned char)+0x1c8 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x3efb0)
     #4 0x0001015fc8c0 in __asan::PlatformUnpoisonStacks()+0x54 
(libclang_rt.asan_osx_dynamic.dylib:arm64e+0x408c0)
     #5 0x000101602e68 in __asan_handle_no_return+0x2c 
(libclang_rt.asan_osx_dynamic.dylib:arm64e+0x46e68)
     #6 0x000100d509e4 in evalcommand eval.c:926
     #7 0x000100d4ed44 in evaltree eval.c:305
     #8 0x000100d52de8 in evaltreenr eval.c:352
     #9 0x000100d51a34 in evalsubshell eval.c:512
     #10 0x000100d4ed44 in evaltree eval.c:305
     #11 0x000100d76894 in cmdloop main.c:244
     #12 0x000100d7638c in main main.c:178
     #13 0x00019e60ab94  (<unknown module>)

Abort trap: 6

-- 
||	modernish -- harness the shell
||	https://github.com/modernish/modernish
||
||	KornShell lives!
||	https://github.com/ksh93/ksh