From owner-freebsd-bugs  Tue Nov 19  4:50: 5 2002
Delivered-To: freebsd-bugs@hub.freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id D3FD837B401
	for <freebsd-bugs@hub.freebsd.org>; Tue, 19 Nov 2002 04:50:03 -0800 (PST)
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 2BDA843E3B
	for <freebsd-bugs@hub.freebsd.org>; Tue, 19 Nov 2002 04:50:03 -0800 (PST)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1])
	by freefall.freebsd.org (8.12.6/8.12.6) with ESMTP id gAJCo1x3095344
	for <freebsd-bugs@freefall.freebsd.org>; Tue, 19 Nov 2002 04:50:01 -0800 (PST)
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.12.6/8.12.6/Submit) id gAJCo1Cb095343;
	Tue, 19 Nov 2002 04:50:01 -0800 (PST)
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 3E60D37B401
	for <FreeBSD-gnats-submit@freebsd.org>; Tue, 19 Nov 2002 04:44:00 -0800 (PST)
Received: from lurza.secnetix.de (lurza.secnetix.de [212.66.1.130])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 7323443E75
	for <FreeBSD-gnats-submit@freebsd.org>; Tue, 19 Nov 2002 04:43:59 -0800 (PST)
	(envelope-from olli@lurza.secnetix.de)
Received: from lurza.secnetix.de (localhost [IPv6:::1])
	by lurza.secnetix.de (8.12.6/8.12.5) with ESMTP id gAJChadK073556;
	Tue, 19 Nov 2002 13:43:36 +0100 (CET)
	(envelope-from oliver.fromme@secnetix.de)
Received: (from olli@localhost)
	by lurza.secnetix.de (8.12.6/8.12.5/Submit) id gAJChZLU073555;
	Tue, 19 Nov 2002 13:43:35 +0100 (CET)
Message-Id: <200211191243.gAJChZLU073555@lurza.secnetix.de>
Date: Tue, 19 Nov 2002 13:43:35 +0100 (CET)
From: Oliver Fromme <olli@secnetix.de>
Reply-To: Oliver Fromme <olli@secnetix.de>
To: FreeBSD-gnats-submit@FreeBSD.org
Cc: Oliver Fromme <olli@fromme.com>
X-Send-Pr-Version: 3.113
Subject: bin/45478: /bin/sh coredump
Sender: owner-freebsd-bugs@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-bugs.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-bugs>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-bugs>
X-Loop: FreeBSD.org


>Number:         45478
>Category:       bin
>Synopsis:       /bin/sh coredump
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Nov 19 04:50:01 PST 2002
>Closed-Date:
>Last-Modified:
>Originator:     Oliver Fromme
>Release:        FreeBSD 4.7-RELEASE i386
>Organization:
secnetix GmbH & Co KG, http://www.secnetix.de/
>Environment:

System: FreeBSD 4.7-RELEASE

I could also reproduce the very same problem on 4.6 and
even on 4.4, so it seems to be a long-standing problem.

>Description:

$ /bin/sh
$ while for true; do false; done; do true; done
^C
$ set -E
sh in malloc(): warning: recursive call
sh in malloc(): warning: recursive call
Segmentation fault (core dumped)

>How-To-Repeat:

See above.  The problem is not 100% reproducible.
Sometimes it happens immediately, sometimes it takes
20+ attempts, but sooner or later it'll crash.
I guess it depends on when exctly you interrupt the
endless while loop.

I can also provide the core dump if necessary.

>Fix:

Sorry, none known.

I suggest someone familiar with the innards of our sh
looks at it.  It's probably easy to track down, using
/etc/malloc.conf and the core dumps ...

>Release-Note:
>Audit-Trail:
>Unformatted:

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message