#966156 dash -n: stack overflow on long sequence of backticks

Package:
dash
Source:
dash
Description:
POSIX-compliant shell
Submitter:
Jakub Wilk
Date:
2023-01-08 13:45:03 UTC
Severity:
normal
Tags:
#966156#3
Date:
2020-07-23 21:50:25 UTC
From:
To:
dash crashes when checking syntax of a script consisting of a very long
sequence of backticks:

   $ printf %09999d | tr 0 '`' | dash -n
   Segmentation fault

Valgrind says it's a stack overflow:

   Process terminating with default action of signal 11 (SIGSEGV)
    Access not within mapped region at address 0xFE33B4C8
   Stack overflow in thread #1: can't grow stack to 0xfe33b000
      at 0x1180EA: UnknownInlinedFun (string_fortified.h:34)
      by 0x1180EA: readtoken1 (parser.c:1377)


Found using American Fuzzy Lop:
http://lcamtuf.coredump.cx/afl/
#966156#8
Date:
2022-12-14 23:42:48 UTC
From:
To:
Valgrind is right. I don't think you're likely to run into this on
non-pathological input, but it's a relatively simple fix.

Patch posted to dash@, archived at forwarded-to.

наб