Invalid pointer when misuse hash/string

[Martin Bruchanov]

Hello,


I've found this bug, when changed an string variable to hash, but left the 
following code for test of zero code.  It happens just inside function. I'm 
using 4.1.2(1)-release,


BASH=/bin/bash

BASHOPTS=checkwinsize:cmdhist:expand_aliases:extquote:force_fignore:hostcomplete:interactive_comments:login_shell:progcomp:promptvars:sourcepath
BASH_VERSINFO=([0]="4" [1]="1" [2]="2" [3]="1" [4]="release" 
[5]="i386-redhat-linux-gnu")
BASH_VERSION='4.1.2(1)-release'


The minimal example:


#!/bin/bash

function bug() {
declare -A hash=""
[ ! -z "$hash" ] && echo test
}

bug

*** glibc detected *** /bin/bash: munmap_chunk(): invalid pointer: 0x080fb47a 
***
======= Backtrace: =========
/lib/libc.so.6[0x3c9e31]
/bin/bash(hash_flush+0x63)[0x8092843]
/bin/bash(assoc_dispose+0x1f)[0x809c5cf]
/bin/bash[0x807860b]
/bin/bash(dispose_variable+0x57)[0x8078677]
/bin/bash(hash_flush+0x58)[0x8092838]
/bin/bash(pop_var_context+0x3e)[0x807743e]
/bin/bash(pop_context+0x18)[0x8077988]
/bin/bash[0x80959ef]
/bin/bash(run_unwind_frame+0x35)[0x8095655]
/bin/bash[0x8075450]
/bin/bash[0x8072dc0]
/bin/bash(execute_command_internal+0x8e0)[0x80737e0]
/bin/bash(execute_command+0x64)[0x80744e4]
/bin/bash(reader_loop+0x97)[0x8060797]
/bin/bash(main+0xd39)[0x805fe19]
/lib/libc.so.6(__libc_start_main+0xe6)[0x36fd26]
/bin/bash[0x805e021]
======= Memory map: ========
00253000-00254000 r-xp 00000000 00:00 0          [vdso]
00333000-00351000 r-xp 00000000 fd:01 167869     /lib/ld-2.12.so
00351000-00352000 r--p 0001d000 fd:01 167869     /lib/ld-2.12.so
00352000-00353000 rw-p 0001e000 fd:01 167869     /lib/ld-2.12.so
00359000-004ea000 r-xp 00000000 fd:01 167870     /lib/libc-2.12.so
004ea000-004ec000 r--p 00191000 fd:01 167870     /lib/libc-2.12.so
004ec000-004ed000 rw-p 00193000 fd:01 167870     /lib/libc-2.12.so
004ed000-004f0000 rw-p 00000000 00:00 0
004f2000-004f5000 r-xp 00000000 fd:01 167877     /lib/libdl-2.12.so
004f5000-004f6000 r--p 00002000 fd:01 167877     /lib/libdl-2.12.so
004f6000-004f7000 rw-p 00003000 fd:01 167877     /lib/libdl-2.12.so
005bd000-005d3000 r-xp 00000000 fd:01 167889     /lib/libtinfo.so.5.7
005d3000-005d6000 rw-p 00015000 fd:01 167889     /lib/libtinfo.so.5.7
006ae000-006cb000 r-xp 00000000 fd:01 164941     
/lib/libgcc_s-4.4.7-20120601.so.1
006cb000-006cc000 rw-p 0001d000 fd:01 164941     
/lib/libgcc_s-4.4.7-20120601.so.1
08047000-08118000 r-xp 00000000 fd:01 196650     /bin/bash
08118000-0811d000 rw-p 000d0000 fd:01 196650     /bin/bash
0811d000-08122000 rw-p 00000000 00:00 0
09bea000-09c0b000 rw-p 00000000 00:00 0          [heap]
b77e9000-b77eb000 rw-p 00000000 00:00 0
b77f4000-b77f6000 rw-p 00000000 00:00 0
bfbaf000-bfbc4000 rw-p 00000000 00:00 0          [stack]
Aborted (core dumped)


Best regard,

BruXy

?