ash: fix out of bounds read in tblentry_copy()

Commit 2ffcb860e (ash: minor fixes to forkshell handling) ensured
that tblentry structures were properly aligned but also resulted
in reads beyond the end of the allocated structure.

1 files changed, 1 insertions, 1 deletions

diff --git a/shell/ash.c b/shell/ash.c
index 20c2590db..9a42b9d78 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -15619,7 +15619,7 @@ tblentry_copy(struct tblentry *tep)
                 size = sizeof(struct tblentry) + align_len(tep->cmdname);
 
                 funcblock = (char *) funcblock + size;
-                memcpy(*newp, tep, size);
+                memcpy(*newp, tep, sizeof(struct tblentry)+strlen(tep->cmdname));
                 switch (tep->cmdtype) {
                 case CMDBUILTIN:
                         /* Save index of builtin, not pointer; fixed by forkshell_init() */