Echoing a large variable with echo -e causes a segfault: #!/bin/bash set -e ulimit -c unlimited tmpgz=$(mktemp) curl -o "$tmpgz" https://ytec.nl/media/many_lines_redacted.txt.gz many_lines=$(zcat "$tmpgz") echo -e "$many_lines" > /dev/null
Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00005a63403d01ad in ?? () (gdb) bt #0 0x00005a63403d01ad in ?? () #1 0x00005a63403a3d73 in echo_builtin () #2 0x00005a634032d63b in ?? () #3 0x00005a6340342eac in ?? () #4 0x00005a634032e9e5 in ?? () #5 0x00005a6340330d16 in execute_command_internal () #6 0x00005a6340334eea in ?? () #7 0x00005a63403323c7 in execute_command_internal () #8 0x00005a63403331b2 in execute_command () #9 0x00005a634031bd4f in reader_loop () #10 0x00005a634030f1f6 in main () [wo sep 2 14:58:10 2026] crashme.sh[3840]: segfault at 5a057b065000 ip 00005a0563d721ad sp 00007ffc4c0e4c80 error 6 in bash[f61ad,5a0563cad000+103000] likely on CPU 1 (core 2, socket 0) [wo sep 2 14:58:10 2026] Code: 4d 8d 6c 24 01 85 c0 75 21 80 7d bf 00 74 1b 89 d8 48 8d 0d c5 62 05 00 c0 e8 05 83 e0 07 8b 04 81 0f a3 d8 0f 83 db 00 00 00 <41> 88 1f 41 0f b6 5c 24 01 49 83 c7 01 4d 89 ec 84 db 75 b3 41 c6 [wo sep 2 15:03:35 2026] crashme.sh[5761]: segfault at 5a637c7fc000 ip 00005a63403d01ad sp 00007ffddb92e360 error 6 in bash[f61ad,5a634030b000+103000] likely on CPU 0 (core 0, socket 0) [wo sep 2 15:03:35 2026] Code: 4d 8d 6c 24 01 85 c0 75 21 80 7d bf 00 74 1b 89 d8 48 8d 0d c5 62 05 00 c0 e8 05 83 e0 07 8b 04 81 0f a3 d8 0f 83 db 00 00 00 <41> 88 1f 41 0f b6 5c 24 01 49 83 c7 01 4d 89 ec 84 db 75 b3 41 c6 Sometimes there are malloc errors on the console. Configuration Information [Automatically generated, do not change]: Machine: x86_64 OS: linux-gnu Compiler: gcc Compilation CFLAGS: -g -O2 -Werror=implicit-function-declaration -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -flto=auto -ffat-lto-objects -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -Wall uname output: Linux trebuchet 7.0.0-30-generic #30-Ubuntu SMP PREEMPT_DYNAMIC Fri Jul 31 18:22:54 UTC 2026 x86_64 GNU/Linux Machine Type: x86_64-pc-linux-gnu Bash Version: 5.3 (Ubuntu 26.04) Patch Level: 9 Release Status: release Also happens in bash 5.1.16(1)-release, in Ubuntu 22.04 Possible security risk; I did not try to make it into an exploit.
