JehanneOS
/
mksh
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix null pointer deref on empty nameref assignment (no ‘=’) 

found by Goodbox on IRC
This commit is contained in:
tg 2014-10-04 11:47:19 +00:00
parent 968dc7a764
commit 40954ce437
3 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
check.t
View File

@ -1,4 +1,4 @@
# $MirOS: src/bin/mksh/check.t,v 1.659 2014/10/03 17:32:09 tg Exp $
# $MirOS: src/bin/mksh/check.t,v 1.660 2014/10/04 11:47:16 tg Exp $
# OpenBSD src/regress/bin/ksh updated: 2013/12/02 20:39:44
#-
# Copyright © 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010,
@ -27,7 +27,7 @@
# http://www.freebsd.org/cgi/cvsweb.cgi/src/tools/regression/bin/test/regress.sh?rev=HEAD
expected-stdout:
@(#)MIRBSD KSH R50 2014/10/03
@(#)MIRBSD KSH R50 2014/10/04
description:
Check version of shell.
stdin:
@ -36,7 +36,7 @@ name: KSH_VERSION
category: shell:legacy-no
---
expected-stdout:
@(#)LEGACY KSH R50 2014/10/03
@(#)LEGACY KSH R50 2014/10/04
description:
Check version of legacy shell.
stdin:

4
sh.h
View File

@ -169,9 +169,9 @@
#endif
#ifdef EXTERN
__RCSID("$MirOS: src/bin/mksh/sh.h,v 1.695 2014/10/03 17:32:12 tg Exp $");
__RCSID("$MirOS: src/bin/mksh/sh.h,v 1.696 2014/10/04 11:47:18 tg Exp $");
#endif
#define MKSH_VERSION "R50 2014/10/03"
#define MKSH_VERSION "R50 2014/10/04"
/* arithmetic types: C implementation */
#if !HAVE_CAN_INTTYPES

8
var.c
View File

@ -28,7 +28,7 @@
#include <sys/sysctl.h>
#endif
__RCSID("$MirOS: src/bin/mksh/var.c,v 1.182 2014/10/03 17:20:03 tg Exp $");
__RCSID("$MirOS: src/bin/mksh/var.c,v 1.183 2014/10/04 11:47:19 tg Exp $");
/*-
* Variables
@ -784,8 +784,9 @@ typeset(const char *var, uint32_t set, uint32_t clr, int field, int base)
/* find value if variable already exists */
if ((qval = val) == NULL) {
varsearch(e->loc, &vp, tvar, hash(tvar));
if (vp != NULL)
qval = str_val(vp);
if (vp == NULL)
goto nameref_empty;
qval = str_val(vp);
}
/* check target value for being a valid variable name */
ccp = skip_varname(qval, false);
@ -803,6 +804,7 @@ typeset(const char *var, uint32_t set, uint32_t clr, int field, int base)
case '-':
goto nameref_rhs_checked;
}
nameref_empty:
errorf("%s: %s", var, "empty nameref target");
}
len = (*ccp == '[') ? array_ref_len(ccp) : 0;