bash reproducibly segfaults while globbing large directory

[Nikita Danilov]

Configuration Information [Automatically generated, do not change]:
Machine: i586
OS: linux
Compiler: gcc -I/usr/src/packages/BUILD/bash-2.05b 
-L/usr/src/packages/BUILD/bash-2.05b/../readline-4.3
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='i586' 
-DCONF_OSTYPE='linux' -DCONF_MACHTYPE='i586-suse-linux' -DCONF_VENDOR='suse' 
-DSHELL -DHAVE_CONFIG_H  -I.  -I. -I./include -I./lib  -O2 -march=i586 
-mcpu=i686 -fmessage-length=0 -Wall -D_GNU_SOURCE -Wall -pipe -g 
-fbranch-probabilities
uname output: Linux tau 2.6.15-dirty #13 SMP Sat Feb 11 18:30:54 MSK 2006 i686 
i686 i386 GNU/Linux
Machine Type: i586-suse-linux

Bash Version: 2.05b
Patch Level: 0
Release Status: release

Description:
    bash 100% reproducibly crashes when trying to do a globbing in a huge
    directory

Repeat-By:

$ bash --version
GNU bash, version 3.00.16(1)-release (i386-redhat-linux-gnu)
Copyright (C) 2004 Free Software Foundation, Inc.
$ ls|wc
 938729  938729 11199200
$ echo $LANG
C
$ echo *
Segmentation fault

In gdb I see following backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x080c3ded in internal_wstrmatch ()
(gdb) bt
#0  0x080c3ded in internal_wstrmatch ()
#1  0x080c4c42 in xstrmatch ()
#2  0x080c1f3f in glob_vector ()
#3  0x080c26cd in glob_filename ()
#4  0x08087a50 in shell_glob_filename ()
#5  0x08081858 in extract_command_subst ()
#6  0x0806c735 in execute_shell_function ()
#7  0x0806afe5 in execute_command_internal ()
#8  0x0806d702 in execute_command ()
#9  0x0805dda1 in reader_loop ()
#10 0x0805d8c9 in main ()

Another person reproduced this with bash 3.1 and directory containing
480k files.

Nikita.