Bug 7688 - ash: segmentation fault with substring at negative offset
Summary: ash: segmentation fault with substring at negative offset
Status: RESOLVED FIXED
Alias: None
Product: Busybox
Classification: Unclassified
Component: Other (show other bugs)
Version: 1.22.x
Hardware: PC Linux
: P5 major
Target Milestone: ---
Assignee: unassigned
URL:
Keywords:
: 8961 (view as bug list)
Depends on:
Blocks:
 
Reported: 2014-12-04 11:31 UTC by Ronald Wahl
Modified: 2018-08-04 20:39 UTC (History)
2 users (show)

See Also:
Host:
Target:
Build:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ronald Wahl 2014-12-04 11:31:11 UTC 
The following command line will crash ash:

a=;echo ${a:$((0-8192))}

It looks like that there is no sanity check for negative offsets. Furthermore bash looks at the string from behind when using negative offsets. This would be a cool feature. Currently I have to fiddle around to achieve this and the above segmentation fault was the fall-out of my testing.

I tested with 1.21.1 and 1.22.1 both show the issue. Others not checked.
Comment 1 Mike Frysinger 2016-05-26 16:20:32 UTC 
*** Bug 8961 has been marked as a duplicate of this bug. ***
Comment 2 Denys Vlasenko 2018-08-04 20:39:34 UTC 
Fixed sometime ago