[klibc] klibc sh segfault on invalid substitutions

[Christoph Anton Mitterer]

Hey there.

There’s a bug in ash-bashed shells, including the one shipped with
klibc.

The original variant is described here (for dash):
https://lore.kernel.org/dash/b2e298215b3d51d8284296484caa138faddaa0e4.camel@scientia.org/
respectively
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1024635


Apparently BusyBox’ sh (also ash based) doesn't segfault with the
example I've found above.

But Harald van Dijk was able to create an example[0] where BusyBox’ sh
segfaults, too, reported by him at:
http://lists.busybox.net/pipermail/busybox/2022-November/090036.html


klibc’s sh segfaults in BOTH cases, and he asked me whether I could
forward this here on also his behalf.


Could you please have a look at both?


It seems theres's no bugtracker for klibc, or is there?
Just that this doesn't get forgotten by accident, I've also reported it
downstream in the Debian BTS at:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1024735


Thanks,
Chris.


[0] $ /usr/lib/klibc/bin/sh -c 'f() { echo ${PWD-${PWD!}}; }; f'
Segmentation fault