ash: further fixes to merge of upstream changesFRP-6075-g169694ebd

Commits e23652908 and 686a0803f (ash: fix execution of applets via
Unix-style path) were necessary following a major revision of the
shell upstream.

Another problem was found:

   $ sh
   $ PATH="/usr/bin;$PATH" exec non-existent

resulted in a segfault.  This happened because during a PATH search
tryexec() modified argv[0] when it detected a Unix-style path (in
this case '/usr/bin/non-existent') but failed to restore it if the
execution failed.

There were other issues:

- The logic of the new code failed to match the original:  the test
  for a Unix-style path should only have happened if an attempt to
  execute the full path had already failed.

- The test for a script running an interpreter which is an applet
  also modified argv.  If the execution failed argv should have
  been restored to its original state.

- During a PATH search the 'path' pointer walked through the
  elements of the path.  This pointer was also used to determine
  if an applet was overridden by an executable.  This is wrong:
  the full PATH variable should have been used.

The code around tryexec()/shellexec() has been rewritten to take
these issues into account.

Adds 32-48 bytes.

(GitHub issue #584)

1 files changed, 60 insertions, 24 deletions

diff --git a/shell/ash.c b/shell/ash.c
index 560effa4a..0a63c434f 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -6943,27 +6943,13 @@ tryexec_applet(int applet_no, int noexec, const char *cmd, char **argv, char **e
 #  define tryexec(c, p, n, a, e) tryexec(c, a, e)
 # endif
 
-static const struct builtincmd *find_builtin(const char *name);
 static void
 tryexec(const char *cmd, const char *path, int noexec, char **argv, char **envp)
 {
 #if ENABLE_FEATURE_SH_STANDALONE
     interp_t interp;
-        int applet_no;
 #endif
 
-        if (unix_path(cmd)) {
-                const char *name = bb_basename(cmd);
-# if ENABLE_FEATURE_SH_STANDALONE
-                if ((applet_no = find_applet_by_name_for_sh(name, path)) >= 0) {
-                        tryexec_applet(applet_no, noexec, name, argv, envp);
-                }
-# endif
-                if (!find_builtin(name)) {
-                        argv[0] = (char *)name;
-                }
-        }
-
         /* Workaround for libtool, which assumes the host is an MSYS2
          * environment and requires special-case escaping for cmd.exe.
          * https://github.com/skeeto/w64devkit/issues/50 */
@@ -6981,9 +6967,12 @@ tryexec(const char *cmd, const char *path, int noexec, char **argv, char **envp)
         /* If the command is a script with an interpreter which is an
          * applet, we can run it as if it were a noexec applet. */
         if (parse_interpreter(cmd, &interp)) {
-                applet_no = find_applet_by_name_for_sh(interp.name, path);
+                int applet_no = find_applet_by_name_for_sh(interp.name, path);
 
                 if (applet_no >= 0) {
+                        char **argv_old = argv;
+                        char *argv0 = argv[0];
+
                         argv[0] = (char *)cmd;
                         /* evalcommand()/spawn_forkshell() add two elements before argv */
                         if (interp.opts) {
@@ -6995,6 +6984,10 @@ tryexec(const char *cmd, const char *path, int noexec, char **argv, char **envp)
                         /* Identify the index of the script file in argv */
                         set_interp(1 + (interp.opts != NULL));
                         tryexec_applet(applet_no, noexec, cmd, argv, envp);
+
+                        // Something went wrong, restore state of argv
+                        argv = argv_old;
+                        cmd = argv[0] = argv0;
                 }
         }
 # endif
@@ -7052,12 +7045,18 @@ tryexec(const char *cmd, char **argv, char **envp)
  * have to change the find_command routine as well.
  * argv[-1] must exist and be writable! See tryexec() for why.
  */
+#if ENABLE_PLATFORM_MINGW32
+static const struct builtincmd *find_builtin(const char *name);
+#endif
 static void shellexec(char *prog, char **argv, const char *path, int idx, int noexec)
 {
         char *cmdname;
         int e;
         char **envp;
         int exerrno;
+#if ENABLE_PLATFORM_MINGW32 && ENABLE_FEATURE_SH_STANDALONE
+        int path_fail = FALSE;
+#endif
 
         envp = listvars(VEXPORT, VUNSET, /*strlist:*/ NULL, /*end:*/ NULL);
 #if ENABLE_FEATURE_SH_STANDALONE && ENABLE_PLATFORM_MINGW32 && defined(_UCRT)
@@ -7068,13 +7067,9 @@ static void shellexec(char *prog, char **argv, const char *path, int idx, int no
                 putenv(*envp++);
         envp = NULL;
 #endif
-#if ENABLE_PLATFORM_MINGW32
-        if (has_path(prog)) {
-                tryexec(stack_add_ext_space(prog), path, noexec, argv, envp);
-#else
+#if !ENABLE_PLATFORM_MINGW32
         if (strchr(prog, '/') != NULL) {
                 tryexec(prog, argv, envp);
-#endif
                 e = errno;
         } else {
 #if ENABLE_FEATURE_SH_STANDALONE
@@ -7089,16 +7084,57 @@ static void shellexec(char *prog, char **argv, const char *path, int idx, int no
                 while (padvance(&path, argv[0]) >= 0) {
                         cmdname = stackblock();
                         if (--idx < 0 && pathopt == NULL) {
-#if ENABLE_PLATFORM_MINGW32
-                                tryexec(cmdname, path, noexec, argv, envp);
-#else
                                 tryexec(cmdname, argv, envp);
-#endif
                                 if (errno != ENOENT && errno != ENOTDIR)
                                         e = errno;
                         }
                 }
         }
+#else /* ENABLE_PLATFORM_MINGW32 */
+        if (has_path(prog)) {
+                tryexec(stack_add_ext_space(prog), path, noexec, argv, envp);
+                e = errno;
+# if ENABLE_FEATURE_SH_STANDALONE
+                path_fail = TRUE;
+# endif
+        }
+        {
+# if ENABLE_FEATURE_SH_STANDALONE
+                const char *path0 = path;
+                int applet_no = find_applet_by_name_for_sh(prog, path);
+                if (applet_no >= 0) {
+                        tryexec_applet(applet_no, noexec, prog, argv, envp);
+                        /* We tried execing ourself, but it didn't work.
+                         * Maybe /proc/self/exe doesn't exist?
+                         */
+                                goto try_PATH;
+                }
+                if (unix_path(prog)) {
+                        const char *name = bb_basename(prog);
+                        if ((applet_no = find_applet_by_name_for_sh(name, path)) >= 0) {
+                                tryexec_applet(applet_no, noexec, name, argv, envp);
+                        }
+                        if (!find_builtin(name)) {
+                                argv[0] = (char *)name;
+                        }
+                }
+                if (!path_fail) {
+ try_PATH:
+# endif
+                        e = ENOENT;
+                        while (padvance(&path, argv[0]) >= 0) {
+                                cmdname = stackblock();
+                                if (--idx < 0 && pathopt == NULL) {
+                                        tryexec(cmdname, path0, noexec, argv, envp);
+                                        if (errno != ENOENT && errno != ENOTDIR)
+                                                e = errno;
+                                }
+                        }
+# if ENABLE_FEATURE_SH_STANDALONE
+                }
+# endif
+        }
+#endif
 
         /* Map to POSIX errors */
         switch (e) {