Bug 410954

Summary: ksh segfaults when using read to fill an array element
Product: [openSUSE] openSUSE 10.3 Reporter: white brian <brian>
Component: OtherAssignee: Dr. Werner Fink <werner>
Status: RESOLVED FIXED QA Contact: E-mail List <qa-bugs>
Severity: Normal    
Priority: P3 - Medium    
Version: Final   
Target Milestone: ---   
Hardware: x86-64   
OS: openSUSE 10.3   
Whiteboard:
Found By: Customer Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description white brian 2008-07-21 17:00:27 UTC
opensuse 10.3 x86_64
ksh (real korn ksh93s, not pdksh)
all applicable on-line updates as of 20080721

When using read to fill anarray element directly, ksh segfaults

This is a "legal" construct and works fine in other versions/platforms of opensuse and other *nix, including at least opensuse 9.1,9.3,10.0,10.1,10.2,10.3 i386, FreeBSD 4.*,5.*,6.* SCO OpenServer 5.0.*, Solaris, going back to at least as far as ksh88 on SCO Xenix and Solaris.
Works on opensuse 10.3 i386
Works on opensuse 11.0 x86_64 and i386

Simplest test:

$ PS1="bash $ "
bash $ ksh
$ PS1="ksh $ "
ksh $ unset AA BB CC
ksh $ # pipe into simple variable via read
ksh $ echo foo |read AA
ksh $ echo $AA
foo
ksh $ # create/use an array element without read
ksh $ BB[1]=foo
ksh $ echo ${BB[1]}
foo
ksh $ # pipe into array element via read
ksh $ echo foo |read CC[1]
Segmentation fault
bash $

Note, sometimes the error is "Memory fault" instead.

work-arounds:
original:
 ... |read A[1]
new:
 ... |read
 A[1]=$REPLY

or original:
 ... |IFS=: read A[$n] B[$n] C[$n] D[$n]
new:
 ... |IFS=: read a b c d
 A[$n]=$a B[$n]=$b C[$n]=$c D[$n]=$d

etc...
Comment 1 Dr. Werner Fink 2008-07-23 10:17:32 UTC
The only problem is that if this error is not security related I'll get a
nogo from the PM for an update from ksh93s 2007-06-28 to ksh93s 2008-02-02.

Are you able to build the ksh93s 2008-02-02 from openSuSE 11.0 on an
openSuSE 10.3 x86_64?
Comment 2 white brian 2008-07-23 15:22:22 UTC
I can't think of a security impact.
I'll try the build today. Thanks for the idea.
Comment 3 white brian 2008-07-24 16:54:01 UTC
Building the ksh93s src rpm from opensuse-11.0-oss works,
and, the generated ksh does not have the bug.

Thank you very much.


# wget http://download.opensuse.org/distribution/11.0/repo/src-oss/suse/src/ksh-93s-114.1.src.rpm

# rpmbuild --rebuild ksh-93s-114.1.src.rpm
...
test select.sh begins at 2008-07-24+10:14:47
test select.sh passed at 2008-07-24+10:14:47 [ 5 tests 0 errors ]
test signal.sh begins at 2008-07-24+10:14:47

[1]+  Stopped                 rpmbuild --rebuild ksh-93s-114.1.src.rpm
ll-aljex:/usr/src/packages/SRPMS # fg 1
rpmbuild --rebuild ksh-93s-114.1.src.rpm

[1]+  Stopped                 rpmbuild --rebuild ksh-93s-114.1.src.rpm
ll-aljex:/usr/src/packages/SRPMS # fg 1
rpmbuild --rebuild ksh-93s-114.1.src.rpm

( 5 more iterations of that, 7 "fg 1" total.
  After the 7th "fg 1[Enter]" the build process resumes. )

...
Wrote: /usr/src/packages/RPMS/x86_64/ksh-93s-114.1.x86_64.rpm
Wrote: /usr/src/packages/RPMS/x86_64/ksh-debuginfo-93s-114.1.x86_64.rpm
Wrote: /usr/src/packages/RPMS/x86_64/ksh-devel-93s-114.1.x86_64.rpm
Executing(--clean): /bin/sh -e /var/tmp/rpm-tmp.94549
+ umask 022
+ cd /usr/src/packages/BUILD
+ rm -rf ksh93
+ exit 0
#

(Next I copied the rpm to my own "aljex" repository on my http install server and ran "createrepo ." there.)

# zypper ref -f aljex
...
# zypper rm ksh
...
# zypper in ksh
...
Downloading package ksh-93s-114.1.x86_64, 1.1 M (2.9 M unpacked)
Downloading: ksh-93s-114.1.x86_64.rpm
* Downloading [100%]
* Installing: ksh-93s-114.1 [100%]
# ksh --version
  version         sh (AT&T Research) 93s+ 2008-01-31
# ksh
# echo foo |read AA[1]
#
(no segfault, so this is already a win just by getting a new prompt, but to finish up...)
# echo ${AA[1]}
foo


Thanks again.


Comment 4 Dr. Werner Fink 2008-09-15 13:26:22 UTC
Fixed in ksh93s+ in openSuSE 11.0