bin/104795: Bug in awk (core dump, easy to reproduce)

[Oliver Fromme]

>Number:         104795
>Category:       bin
>Synopsis:       Bug in awk (core dump, easy to reproduce)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Oct 25 13:10:22 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator:     Oliver Fromme
>Release:        FreeBSD 6.2-PRERELEASE i386
>Organization:
secnetix GmbH & Co. KG
		http://www.secnetix.de/bsd
>Environment:

	Bug found on FreeBSD/i386 RELENG_6 (6.2-PRERELEASE).

>Description:

	Our awk (bsd awk) seems to coredump when a function
	locally assigns a string to a parameter that was
	initialized by the function call to a non-zero
	numeric value.

>How-To-Repeat:

	This is the smallest snippet that reproduces the
	problem described above:

	# awk 'function f(x) {x=""} BEGIN {f(1)}'
	awk in free(): error: junk pointer, too low to make sense
	Abort trap (core dumped)

>Fix:
	unknown
>Release-Note:
>Audit-Trail:
>Unformatted: