Echoing Unicode characters makes bash crash

[dalbani]

Issue Report

Bug

CoreOS Version

NAME=CoreOS
ID=coreos
VERSION=1010.5.0
VERSION_ID=1010.5.0
BUILD_ID=2016-05-26-2225
PRETTY_NAME="CoreOS 1010.5.0 (MoreOS)"

Environment

DigitalOcean (CoreOS stable droplet)

Expected Behavior

Bash doesn't crash.

Actual Behavior

Bash crashes.

Reproduction Steps

1. run for example echo -e '\u1F3B7'

Other Information

core@coreos ~ $ echo -e '\u1F3B7'
*** Error in `bash': double free or corruption (out): 0x000055da1ff00300 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x77677)[0x7f05bd534677]
/lib64/libc.so.6(+0x7d4f7)[0x7f05bd53a4f7]
/lib64/libc.so.6(+0x7dd5b)[0x7f05bd53ad5b]
bash(echo_builtin+0x196)[0x55da1df81656]
bash(+0x3420d)[0x55da1df3420d]
bash(+0x366b0)[0x55da1df366b0]
bash(execute_command_internal+0xa42)[0x55da1df37562]
bash(execute_command+0x75)[0x55da1df392f5]
bash(reader_loop+0x1c6)[0x55da1df1f4e6]
bash(main+0xe45)[0x55da1df1d8c5]
/lib64/libc.so.6(__libc_start_main+0x114)[0x7f05bd4dda24]
bash(_start+0x29)[0x55da1df1e339]
======= Memory map: ========
55da1df00000-55da1dfcb000 r-xp 00000000 fe:03 162901                     /usr/bin/bash
55da1e1ca000-55da1e1cd000 r--p 000ca000 fe:03 162901                     /usr/bin/bash
55da1e1cd000-55da1e1d0000 rw-p 000cd000 fe:03 162901                     /usr/bin/bash
55da1e1d0000-55da1e1d5000 rw-p 00000000 00:00 0 
55da1fec8000-55da1ff0a000 rw-p 00000000 00:00 0                          [heap]
7f05bd09a000-7f05bd0b0000 r-xp 00000000 fe:03 32547                      /usr/lib64/libgcc_s.so.1
7f05bd0b0000-7f05bd2af000 ---p 00016000 fe:03 32547                      /usr/lib64/libgcc_s.so.1
7f05bd2af000-7f05bd2b0000 r--p 00015000 fe:03 32547                      /usr/lib64/libgcc_s.so.1
7f05bd2b0000-7f05bd2b1000 rw-p 00016000 fe:03 32547                      /usr/lib64/libgcc_s.so.1
7f05bd2b1000-7f05bd2bc000 r-xp 00000000 fe:03 40439                      /usr/lib64/libnss_files-2.21.so
7f05bd2bc000-7f05bd4bb000 ---p 0000b000 fe:03 40439                      /usr/lib64/libnss_files-2.21.so
7f05bd4bb000-7f05bd4bc000 r--p 0000a000 fe:03 40439                      /usr/lib64/libnss_files-2.21.so
7f05bd4bc000-7f05bd4bd000 rw-p 0000b000 fe:03 40439                      /usr/lib64/libnss_files-2.21.so
7f05bd4bd000-7f05bd65d000 r-xp 00000000 fe:03 40454                      /usr/lib64/libc-2.21.so
7f05bd65d000-7f05bd85d000 ---p 001a0000 fe:03 40454                      /usr/lib64/libc-2.21.so
7f05bd85d000-7f05bd861000 r--p 001a0000 fe:03 40454                      /usr/lib64/libc-2.21.so
7f05bd861000-7f05bd863000 rw-p 001a4000 fe:03 40454                      /usr/lib64/libc-2.21.so
7f05bd863000-7f05bd868000 rw-p 00000000 00:00 0 
7f05bd868000-7f05bd86b000 r-xp 00000000 fe:03 40451                      /usr/lib64/libdl-2.21.so
7f05bd86b000-7f05bda6a000 ---p 00003000 fe:03 40451                      /usr/lib64/libdl-2.21.so
7f05bda6a000-7f05bda6b000 r--p 00002000 fe:03 40451                      /usr/lib64/libdl-2.21.so
7f05bda6b000-7f05bda6c000 rw-p 00003000 fe:03 40451                      /usr/lib64/libdl-2.21.so
7f05bda6c000-7f05bdac5000 r-xp 00000000 fe:03 40235                      /usr/lib64/libncurses.so.5.9
7f05bdac5000-7f05bdcc5000 ---p 00059000 fe:03 40235                      /usr/lib64/libncurses.so.5.9
7f05bdcc5000-7f05bdcc9000 r--p 00059000 fe:03 40235                      /usr/lib64/libncurses.so.5.9
7f05bdcc9000-7f05bdcca000 rw-p 0005d000 fe:03 40235                      /usr/lib64/libncurses.so.5.9
7f05bdcca000-7f05bdd12000 r-xp 00000000 fe:03 40889                      /usr/lib64/libreadline.so.6.3
7f05bdd12000-7f05bdf12000 ---p 00048000 fe:03 40889                      /usr/lib64/libreadline.so.6.3
7f05bdf12000-7f05bdf15000 r--p 00048000 fe:03 40889                      /usr/lib64/libreadline.so.6.3
7f05bdf15000-7f05bdf1b000 rw-p 0004b000 fe:03 40889                      /usr/lib64/libreadline.so.6.3
7f05bdf1b000-7f05bdf1c000 rw-p 00000000 00:00 0 
7f05bdf1c000-7f05bdf3f000 r-xp 00000000 fe:03 40455                      /usr/lib64/ld-2.21.so
7f05be134000-7f05be138000 rw-p 00000000 00:00 0 
7f05be13a000-7f05be13e000 rw-p 00000000 00:00 0 
7f05be13e000-7f05be13f000 r--p 00022000 fe:03 40455                      /usr/lib64/ld-2.21.so
7f05be13f000-7f05be140000 rw-p 00023000 fe:03 40455                      /usr/lib64/ld-2.21.so
7f05be140000-7f05be141000 rw-p 00000000 00:00 0 
7ffc72e04000-7ffc72e25000 rw-p 00000000 00:00 0                          [stack]
7ffc72f0b000-7ffc72f0e000 r--p 00000000 00:00 0                          [vvar]
7ffc72f0e000-7ffc72f10000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
Aborted (core dumped)

[mischief]

can't reproduce on bash-4.3_p42-r1, so we should probably update it.

[dalbani]

Happy to see the merge request!
I'm all for upgrading to bash 4.3, given the new features therein (e.g. nameref variables).