diff options
author | Denys Vlasenko <vda.linux@googlemail.com> | 2019-02-04 16:16:30 +0100 |
---|---|---|
committer | Denys Vlasenko <vda.linux@googlemail.com> | 2019-02-04 16:16:30 +0100 |
commit | 779f96a24c43209be841f9cc0e7715a2c57db487 (patch) | |
tree | 0b58a75310a884b29556e4fd0904c3d2486c80a8 | |
parent | e17e8d4b7da27f28956253104218d53328f31995 (diff) | |
download | busybox-w32-779f96a24c43209be841f9cc0e7715a2c57db487.tar.gz busybox-w32-779f96a24c43209be841f9cc0e7715a2c57db487.tar.bz2 busybox-w32-779f96a24c43209be841f9cc0e7715a2c57db487.zip |
lineedit: fix SEGV in isk, hexedit, ed, closes 11661
fdisk, hexedit and ed calls read_line_edit in libbb/lineedit.c with NULL
as first argument. On line 2373 of lineedit.c of busybox version 1.29.3,
state->hist_file is referenced without checking the state->flag.
This causes segmentation fault on fdisk, hexedit and ed on ARM Cortex-A9.
It somehow works on x86_64.
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
-rw-r--r-- | libbb/lineedit.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/libbb/lineedit.c b/libbb/lineedit.c index 0a888fa70..1d5fef5ee 100644 --- a/libbb/lineedit.c +++ b/libbb/lineedit.c | |||
@@ -2383,13 +2383,14 @@ int FAST_FUNC read_line_input(line_input_t *st, const char *prompt, char *comman | |||
2383 | timeout = st->timeout; | 2383 | timeout = st->timeout; |
2384 | } | 2384 | } |
2385 | #if MAX_HISTORY > 0 | 2385 | #if MAX_HISTORY > 0 |
2386 | if (state->flags & DO_HISTORY) { | ||
2386 | # if ENABLE_FEATURE_EDITING_SAVEHISTORY | 2387 | # if ENABLE_FEATURE_EDITING_SAVEHISTORY |
2387 | if (state->hist_file) | 2388 | if (state->hist_file) |
2388 | if (state->cnt_history == 0) | 2389 | if (state->cnt_history == 0) |
2389 | load_history(state); | 2390 | load_history(state); |
2390 | # endif | 2391 | # endif |
2391 | if (state->flags & DO_HISTORY) | ||
2392 | state->cur_history = state->cnt_history; | 2392 | state->cur_history = state->cnt_history; |
2393 | } | ||
2393 | #endif | 2394 | #endif |
2394 | 2395 | ||
2395 | /* prepare before init handlers */ | 2396 | /* prepare before init handlers */ |