While fuzzing GNU bash version 4.3.42(1)-release (x86_64-unknown-linux-gnu) with AFL(http://lcamtuf.coredump.cx/afl), I stumbled upon a 4-byte 'script' that triggers a null ptr deref and causes a segfault.

OS: Debian 7 (3.2.68-1+deb7u3 x86_64)
libc: 2.13-38+deb7u8
gcc: 4.92

Script: Attached
Hexdump:
0000000 3b21 2620                             
0000004

Valgrind:
==9729== Invalid read of size 1
==9729==    at 0x4C29B72: __strlen_sse42 (vg_replace_strmem.c:424)
==9729==    by 0x49FA6F: execute_simple_command (execute_cmd.c:3944)
==9729==    by 0x4AABD7: execute_command_internal (execute_cmd.c:787)
==9729==    by 0x4AF1A2: execute_connection (execute_cmd.c:2466)
==9729==    by 0x4AF1A2: execute_command_internal (execute_cmd.c:945)
==9729==    by 0x4B2C7C: execute_command (execute_cmd.c:390)
==9729==    by 0x42E41F: reader_loop (eval.c:160)
==9729==    by 0x426566: main (shell.c:756)
==9729==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==9729==
==9729==
==9729== Process terminating with default action of signal 11 (SIGSEGV)
==9729==  Access not within mapped region at address 0x0
==9729==    at 0x4C29B72: __strlen_sse42 (vg_replace_strmem.c:424)
==9729==    by 0x49FA6F: execute_simple_command (execute_cmd.c:3944)
==9729==    by 0x4AABD7: execute_command_internal (execute_cmd.c:787)
==9729==    by 0x4AF1A2: execute_connection (execute_cmd.c:2466)
==9729==    by 0x4AF1A2: execute_command_internal (execute_cmd.c:945)
==9729==    by 0x4B2C7C: execute_command (execute_cmd.c:390)
==9729==    by 0x42E41F: reader_loop (eval.c:160)
==9729==    by 0x426566: main (shell.c:756)
==9729==  If you believe this happened as a result of a stack
==9729==  overflow in your program's main thread (unlikely but
==9729==  possible), you can try to increase the size of the
==9729==  main thread stack using the --main-stacksize= flag.
==9729==  The main thread stack size used in this run was 8388608.
Segmentation fault

GDB:
Program received signal SIGSEGV, Segmentation fault.
__strlen_sse42 () at ../sysdeps/x86_64/multiarch/strlen-sse4.S:32
32 ../sysdeps/x86_64/multiarch/strlen-sse4.S: No such file or directory.
(gdb) bt
#0  __strlen_sse42 () at ../sysdeps/x86_64/multiarch/strlen-sse4.S:32
#1  0x000000000049fa70 in execute_simple_command () at execute_cmd.c:3944
#2  0x00000000004aabd8 in execute_command_internal () at execute_cmd.c:787
#3  0x00000000004af1a3 in execute_command_internal () at execute_cmd.c:2466
#4  0x00000000004b2c7d in execute_command () at execute_cmd.c:390
#5  0x000000000042e420 in reader_loop ()
#6  0x0000000000426567 in main () at shell.c:756
(gdb) i r
rax            0x0 0
rbx            0x0 0
rcx            0x0 0
rdx            0x1 1
rsi            0xffffff00 4294967040
rdi            0x0 0
rbp            0x0 0x0
rsp            0x7fffffffde68 0x7fffffffde68
r8             0x0 0
r9             0x0 0
r10            0x0 0
r11            0x1 1
r12            0xac8bc8 11307976
r13            0xac8c88 11308168
r14            0x0 0
r15            0x0 0
rip            0x7ffff773f8cf 0x7ffff773f8cf <__strlen_sse42+15>
eflags         0x10246 [ PF ZF IF RF ]
cs             0x33 51
ss             0x2b 43
ds             0x0 0
es             0x0 0
fs             0x0 0
gs             0x0 0