diff options
| author | Karsten Sperling <ksperling@apple.com> | 2023-05-18 16:47:49 +0200 |
|---|---|---|
| committer | Denys Vlasenko <vda.linux@googlemail.com> | 2023-05-18 16:49:54 +0200 |
| commit | 3e83699ce23400d75c7ddaa7ebfdec015177caa7 (patch) | |
| tree | 25a58abe8809a5df3a6e73a08c8b7887804772db | |
| parent | c5682813abb2f24a7ab026c905af73eea58cb621 (diff) | |
| download | busybox-w32-3e83699ce23400d75c7ddaa7ebfdec015177caa7.tar.gz busybox-w32-3e83699ce23400d75c7ddaa7ebfdec015177caa7.tar.bz2 busybox-w32-3e83699ce23400d75c7ddaa7ebfdec015177caa7.zip | |
ash: use-after-free in bash pattern substitution
Commit daa66ed6 fixed a number of use-after-free bugs in bash pattern
substitution, however one "unguarded" STPUTC remained, which is fixed here.
function old new delta
subevalvar 1564 1576 +12
Signed-off-by: Karsten Sperling <ksperling@apple.com>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
| -rw-r--r-- | shell/ash.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/shell/ash.c b/shell/ash.c index d2c5c5d50..51b627fcc 100644 --- a/shell/ash.c +++ b/shell/ash.c | |||
| @@ -7370,6 +7370,8 @@ subevalvar(char *start, char *str, int strloc, | |||
| 7370 | char *restart_detect = stackblock(); | 7370 | char *restart_detect = stackblock(); |
| 7371 | if (quotes && *loc == '\\') { | 7371 | if (quotes && *loc == '\\') { |
| 7372 | STPUTC(CTLESC, expdest); | 7372 | STPUTC(CTLESC, expdest); |
| 7373 | if (stackblock() != restart_detect) | ||
| 7374 | goto restart; | ||
| 7373 | len++; | 7375 | len++; |
| 7374 | } | 7376 | } |
| 7375 | STPUTC(*loc, expdest); | 7377 | STPUTC(*loc, expdest); |