[comp.bugs.sys5] A tiny bug in Csh which could be quite painful

rec@dg.dg.com (Robert Cousins) (06/20/89)

I have found that there are several basic bugs in the Cshell history
mechanism which can be quite problematic.  These were originally called
to my attention by the work of a couple of researchers at the U of W in
Madison.  Bug 1:

	!a%999999999f

which causes 999999999 spaces to be output to the screen.  (Fewer on
16 bit machines.)  It seems that the error message in the history
module goes through the first argument of a printf() call and can be
interpreted as a format.  A second bug, which happens on fewer machines
takes place with:

	!a%f%f

which can cause csh to dump core from a floating point error.  
Comments?

I've tried this on almost every machine I can get my hands on and the first
bug is definitely there on everyone.  For a reasonable variation, try
differing format specifications.  Use of fractional and negative field
widths can bring about interesting outputs!

Robert Cousins
Dept. Mgr, Workstation Dev't.
Data General Corp.

Speaking for myself alone.