Hello, I found a reproducible use-after-free in every version of Bash from 4.4-5.0beta, that could potentially be used to escape restricted mode. I say potentially, because I can get it to crash in restricted mode, but I haven't gone through the effort of attempting to heap spray to overwrite function pointers.
I read in previous threads that you don't consider most crashes in Bash to be security issues, but before I posted something to the public mailing list, I wanted to be sure that this was the correct place to do so. If not, who should I email? I have a writeup, with repro and patch that I think should work. :) Thanks! Corbin Souffrant
