Bug 613686 – app-shells/bash-4.3_p48-r1: stack smashing detected

• Status: RESOLVED FIXED
• Product: Gentoo Linux

[Description Alex Efros 2017-03-23 20:53:07 UTC]

This script crash bash when executed as "sh" instead of "bash":

$ bash wait-bug.sh 
wait-bug.sh: line 8: kill: (27280) - No such process
wait-bug.sh: line 8: kill: (27281) - No such process
wait-bug.sh: line 8: kill: (27283) - No such process
wait-bug.sh: line 8: kill: (27284) - No such process
done
$ sh wait-bug.sh 
wait-bug.sh: line 8: kill: (27290) - No such process
*** stack smashing detected ***: sh terminated; report to <http://bugs.gentoo.org/>
Killed
$ ls -l /bin/sh /bin/bash
-rwxr-xr-x 1 root root 833968 Dec  9 23:04 /bin/bash
lrwxrwxrwx 1 root root      4 Dec  9 23:04 /bin/sh -> bash

Kernel log:
user.err: Jan  6 2017 10:01:59 glibc-gentoo-hardened-check: *** stack smashing detected ***: sh terminated; report to <http://bugs.gentoo.org/>

If you replace "CRASH" line with "DO NOT CRASH" line - guess what happens. :)
It looks like only sh triggers this issue because `wait` works differently in bash - it doesn't returns on each SIGCHLD like in sh and thus don't enter the loop body with $(date).

--- wait-bug.sh ---
sleep 5 & mainpid=$!

function _task {
	sleep 1 & taskpid=$!
}

function taskautorun {
	[ -n "$taskpid" ] && kill -0 $taskpid || _task
}

set -m
taskautorun
trap taskautorun SIGCHLD

until wait $mainpid; do 
	echo $(date)    # CRASH
	# echo message    # DO NOT CRASH
done

echo done
--- cut ---

[Comment 1 Sam James 2020-10-25 20:32:26 UTC]

Still happening?

[Comment 2 Alex Efros 2020-10-26 05:08:11 UTC]

No, it's not happening anymore.