#911432 posh-0.13.2 massive memory leak / segfault

Package:
posh
Source:
posh
Description:
Policy-compliant Ordinary SHell
Submitter:
"orbea@fredslev.dk"
Date:
2018-12-16 14:09:06 UTC
Severity:
normal
#911432#5
Date:
2018-10-20 04:04:44 UTC
From:
To:
I have found that when trying to use a function called 'echo' which
also calls the 'echo' builtin posh will hang while leaking several GBs
of memory and then segfaulting.

  echo () { echo foo; } ; echo

When I rebuilt posh with '-O0 -g' the amount of memory its leaks is
much greater and it seems like I will run out of swap before it
segfaults, maybe this is an infinite loop?

When running posh in gdb and getting a backtrace while posh is leaking
memory by pressing ctrl+c I find that gdb will also enter an infinite
loop...

I have attached a very large backtrace compressed with xz and a short
example script that will demonstrate the problem. Please take care when
testing it.
#911432#10
Date:
2018-10-20 12:16:49 UTC
From:
To:
Hello,
just tried to reproduce this issue.

And I think this is "just" a recursion.

Also bash shows this behaviour.
(except it just allocates 132MB instead of
exchausting the whole physical memory.)

Are you maybe trying to achive something like this?

  echo () { /bin/echo foo; } ; echo

Kind regards,
Bernhard
#911432#13
Date:
2018-10-20 12:16:49 UTC
From:
To:
Hello,
just tried to reproduce this issue.

And I think this is "just" a recursion.

Also bash shows this behaviour.
(except it just allocates 132MB instead of
exchausting the whole physical memory.)

Are you maybe trying to achive something like this?

  echo () { /bin/echo foo; } ; echo

Kind regards,
Bernhard
#911432#18
Date:
2018-10-20 13:34:30 UTC
From:
To:
Hi,

I was trying to make a test case that shows how 'unset -f' is still
broken, see this other issue.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=911395

I thought I tested this in other shells, but I was apparently mistaken
and you are right that bash shares this behavior with a far lesser
severity.

It seems most shells will just segfault immediately while a few
actually handled this.

$ ksh
$ echo () { echo foo; }; echo
ksh: echo: recursion too deep

$ zsh
% echo () { echo foo; }; echo
echo: maximum nested function level reached; increase FUNCNEST

Regardless, posh probably could handle this better, this could be a
good way to bring down a system with posh installed...
#911432#23
Date:
2018-10-20 16:23:12 UTC
From:
To:
After I spent time talking about this in #!/bin/mksh @ freenode I think
the expected behavior is a segfault. The massive memory leak is
potentially dangerous and this could fail in a safer way.