Hi,

Certain arguments cause csh to lock up and endlessly consume memory
until killed. I'm guessing this happens during parsing because the
code doesn't have to actually be executed.

The most I've been able to narrow it down is that it happens when a
command line contains both a backslash and an unquoted ܠ (U+0720
SYRIAC LETTER LAMADH).

Examples that trigger it:

true \ܠ

if (0) true \ܠ

true \ foo bar baz ܠ

true '\' ܠ

Examples that don't trigger it:

true ܠ

true \ 'ܠ'

I didn't manage to reproduce this on OpenBSD but I didn't try very
hard.

(This problem was found while fuzzing another piece of software.)

Hi,

I was (also) fuzzing another piece of software and ran into the same
issue. I believe I was able to narrow down the cause of the  problem a
little bit more.

Rather than it being caused by the specific combination of a backslash
and an unquoted U+0720 character I found it can be caused by:
1. Either a backslash or a quoted subcommand (e.g. the substring "'foo'"
   in "'foo'bar"), and
2. A character whose utf-8 encoding includes the bytes 0xA0.

In the case of U+0720, it's utf-8 encoding is '0xDD 0xA0'.

One thing I noticed, and I can't say for sure if this is related, is
that U+00A0 is the "No-Break Space" (NBSP) character. Since whitespace
can have special meanings for shell input I figured it might be related.