Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!cwjcc!kiwi!chet
From: chet@kiwi.CWRU.EDU (Chet Ramey)
Newsgroups: gnu.bash.bug
Subject: Re: Bug in bash 1.01
Summary: FIX
Message-ID: <400@cwjcc.CWRU.Edu>
Date: 5 Jul 89 18:42:25 GMT
References: <8907041812.AA01639@ccvi.ccv.fr>
Sender: news@cwjcc.CWRU.Edu
Reply-To: chet@kiwi.INS.CWRU.Edu (Chet Ramey)
Distribution: gnu
Organization: CWRU Andrew R. Jennings Computing Center
Lines: 54

In article <8907041812.AA01639@ccvi.ccv.fr> jdf@ccvi.ccv.fr (Jean-Daniel Fekete) writes:

>The following make bash barf in free.

>function zap()
>{
	...
>        kill -KILL $pid &> /dev/null
	...
>}

>unset zap


It's the redirections that are doing it.  It's dispose_redirects() that is
calling free() twice with the same redirection record (actually a portion
of the same redirection record -- the filename).

The problem is that when the command was copied (when the function was
bound), the case of r_err_and_out was left out of the case statement in
copy_cmd.c: copy_redirect(), so the filename part of the redirection struct
never got copied, and was shared by both the command struct built by
yyparse() and the command struct that is part of the function definition
(whew :-).  When the function definition was read and parsed, and the
function installed, the command tree built in yyparse() was freed, and
along with it the redirection info.  Then, in unset_builtin, the copy of
the command tree associated with the function struct was freed.  The
redirection info never was copied, so it was freed twice. 

The fix is amazingly simple.  Once again, it is not the Officially Blessed
fix; Brian might decide to do something different.  However, it works.

*** bash-1.01/copy_cmd.c	Fri Jun 23 00:47:13 1989
--- src-1.01/copy_cmd.c	Wed Jul  5 13:36:12 1989
***************
*** 96,99
    case r_input_direction:
    case r_inputa_direction:
      new_redirect->redirectee.filename =
        copy_word (redirect->redirectee.filename);

--- 96,100 -----
    case r_input_direction:
    case r_inputa_direction:
+   case r_err_and_out:
      new_redirect->redirectee.filename =
        copy_word (redirect->redirectee.filename);



Chet Ramey			"We are preparing to think about contemplating 
Network Services Group, CWRU	 preliminary work on plans to develop a
chet@cwjcc.INS.CWRU.Edu		 schedule for producing the 10th Edition of 
				 the Unix Programmers Manual." -- Andrew Hume