mainThe GNU Bourne-Again SHell - Support: sr #110948, Brace expansion dereferences a...


sr #110948: Brace expansion dereferences a NULL pointer if size is too large.

Submitter:  None
Submitted:  Mon 23 Oct 2023 08:37:24 PM UTC
Category:  None Priority:  5 - Normal
Severity:  3 - Normal Status:  Done
Privacy:  Public Assigned to:  None
Originator Email:  -email is unavailable- Open/Closed:  Open
Operating System:  GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup

Mon 30 Oct 2023 08:07:32 PM UTC, comment #1: 

Thanks for the report.

Chet Ramey <chet>
Group administrator
Mon 23 Oct 2023 08:37:24 PM UTC, original submission:  

Bug is still present in commit: 66ab85f556aa4bc5038bc93525d47c26c2f0b777

Detailed Description:

Brace Expansion with very large possible combinations crashes due to a failed memory allocation. On my system, the limit for malloc is 1TiB, on larger allocations NULL is returned.

The allocation causing the problem was identified with address-sanitizer as coming from the stack trace:

==138780==ERROR: AddressSanitizer: requested allocation size 0xfffffffea61ca410 (0xfffffffea61cb410 after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000 (thread T0)
    #0 0x7f84512e1359 in __interceptor_malloc /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0x559749ab2529 in array_concat /home/alex/build/bash-git/src/bash/braces.c:759
    #2 0x559749aaef35 in brace_expand /home/alex/build/bash-git/src/bash/braces.c:272
    #3 0x559749a7a3e5 in brace_expand_word_list /home/alex/build/bash-git/src/bash/subst.c:12446
    #4 0x559749a7d72b in expand_word_list_internal /home/alex/build/bash-git/src/bash/subst.c:12994
    #5 0x559749a79a17 in expand_words /home/alex/build/bash-git/src/bash/subst.c:12280
    #6 0x5597499ec945 in execute_simple_command /home/alex/build/bash-git/src/bash/execute_cmd.c:4506
    #7 0x5597499d8b4f in execute_command_internal /home/alex/build/bash-git/src/bash/execute_cmd.c:866
    #8 0x559749af758d in parse_and_execute /home/alex/build/bash-git/src/bash/builtins/evalstring.c:539
    #9 0x5597499a0344 in run_one_command /home/alex/build/bash-git/src/bash/shell.c:1473
    #10 0x55974999e664 in main /home/alex/build/bash-git/src/bash/shell.c:763
    #11 0x7f8451045ccf  (/usr/lib/ (BuildId: 8bfe03f6bf9b6a6e2591babd0bbc266837d8f658)

Without address-sanitizer, malloc simply returns NULL instead of failing, which causes the code on subst.c:12448 to dereference a NULL pointer. Comments were added to the following code snippet to show the problem.

      if (mbschr (tlist->word->word, LBRACE))
// the next line assings expansions = NULL for very large braces
          expansions = brace_expand (tlist->word->word);
// expansions[eindex] dereferences a NULL
          for (eindex = 0; temp_string = expansions[eindex]; eindex++)

The Bug is not very severe, as the program will probably crash with a SIGSEGV on all systems when it tries to dereference NULL[0]. The address dereferenced can not be controlled, so it probably offers no security problems.

Ideally, bash would produce a readable error instead of crashing when malloc brace_expand returns a NULL pointer.

Can be reproduced with the command on my machine. Depending on your malloc size limit, larger brace expansions may be required:

echo {0..1000000}{0..1000000}



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by chet (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.


    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2023-10-30 chet StatusNone Done

    Back to the top

    Powered by Savane 3.13-3736.
    Corresponding source code