ash: fix segfault in "command -v"

1 files changed, 24 insertions, 12 deletions

diff --git a/shell/ash.c b/shell/ash.c
index 77fe91a24..08bdfc3b3 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -1575,14 +1575,14 @@ static char *optionarg;                /* set by nextopt (like getopt) */
 static char *optptr;                   /* used by nextopt */
 
 /*
- * XXX - should get rid of.  have all builtins use getopt(3).  the
- * library getopt must have the BSD extension static variable "optreset"
- * otherwise it can't be used within the shell safely.
+ * XXX - should get rid of. Have all builtins use getopt(3).
+ * The library getopt must have the BSD extension static variable
+ * "optreset", otherwise it can't be used within the shell safely.
  *
- * Standard option processing (a la getopt) for builtin routines.  The
- * only argument that is passed to nextopt is the option string; the
- * other arguments are unnecessary.  It return the character, or '\0' on
- * end of input.
+ * Standard option processing (a la getopt) for builtin routines.
+ * The only argument that is passed to nextopt is the option string;
+ * the other arguments are unnecessary. It returns the character,
+ * or '\0' on end of input.
  */
 static int
 nextopt(const char *optstring)
@@ -1593,13 +1593,20 @@ nextopt(const char *optstring)
 
         p = optptr;
         if (p == NULL || *p == '\0') {
+                /* We ate entire "-param", take next one */
                 p = *argptr;
-                if (p == NULL || *p != '-' || *++p == '\0')
+                if (p == NULL)
+                        return '\0';
+                if (*p != '-')
+                        return '\0';
+                if (*++p == '\0') /* just "-" ? */
                         return '\0';
                 argptr++;
-                if (LONE_DASH(p))        /* check for "--" */
+                if (LONE_DASH(p)) /* "--" ? */
                         return '\0';
+                /* p => next "-param" */
         }
+        /* p => some option char in the middle of a "-param" */
         c = *p++;
         for (q = optstring; *q != c;) {
                 if (*q == '\0')
@@ -1608,8 +1615,11 @@ nextopt(const char *optstring)
                         q++;
         }
         if (*++q == ':') {
-                if (*p == '\0' && (p = *argptr++) == NULL)
-                        ash_msg_and_raise_error("no arg for -%c option", c);
+                if (*p == '\0') {
+                        p = *argptr++;
+                        if (p == NULL)
+                                ash_msg_and_raise_error("no arg for -%c option", c);
+                }
                 optionarg = p;
                 p = NULL;
         }
@@ -7421,8 +7431,10 @@ commandcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
                 else if (c != 'p')
                         abort();
 #endif
-        if (verify)
+        /* Mimic bash: just "command -v" doesn't complain, it's a nop */
+        if (verify && (*argptr != NULL)) {
                 return describe_command(*argptr, verify - VERIFY_BRIEF);
+        }
 
         return 0;
 }