Report
Potential heap overflow in bash array_to_string_internal due to strcpy after custom resize macro
a707d892-8e47-4f83-8bd2-0f9bd9f60a62
array_to_string_internal in array.c builds a concatenated string using RESIZE_MALLOCED_BUFFER and then copies element strings and separators with strcpy(result + rlen, ...). Buffer growth is driven by int arithmetic (rlen/rsize/reg/slen). If length arithmetic overflows or the resize room calculation doesn't fully cover bytes written (including separator and final NUL), strcpy can write past the allocated heap buffer, causing memory corruption.