Bug with arrays in comma separated arithmetic expressions

[Alexander Holler]

Hello,

I've discovered a bug in bash 4.2.x (including 4.2.45) which leads to a 
segfault:

----snip----
#!/bin/bash

# this code doesn't make sense and just is a testcase for a bug

a=()
b=0
a[b]=1

((c=b/a[b], c=b%a[b]))
----snip----

I've digged a bit through the bash source and the culprit seems to be in 
expr.c function expassign():

----snip----
/* save ind in case rhs is string var and evaluation overwrites it */
lind = curlval.ind;

(...)

if (lind != -1)
  expr_bind_array_element (lhs, lind, rhs);
else
  expr_bind_variable (lhs, rhs);
----snip----

What happens is that expr_bind_array_element() is called instead of 
expr_bind_variable().

The bug doesn't seem to exist in bash 4.3-beta2, therefor I haven't 
looked further, but it might be worse a patch for 4.2.

Regards,

Alexander Holler