From 5f0269ed9af532aa54ffcb4b2c67a6144fb500fc Mon Sep 17 00:00:00 2001
From: tg <tg@mirbsd.org>
Date: Mon, 14 Jul 2008 12:29:06 +0000
Subject: [PATCH] fix attempt to free pointer to stack (function-local storage)
 discovered by Elias Pipping patch by Jared Yanovich alloc/afree checker by
 Todd C. Miller

---
 check.t | 16 ++++++++++++++--
 funcs.c |  8 ++------
 sh.h    |  4 ++--
 syn.c   |  7 ++++++-
 4 files changed, 24 insertions(+), 11 deletions(-)

diff --git a/check.t b/check.t
index 4f1d565..f87d5f4 100644
--- a/check.t
+++ b/check.t
@@ -1,4 +1,4 @@
-# $MirOS: src/bin/mksh/check.t,v 1.215 2008/07/12 18:09:36 tg Exp $
+# $MirOS: src/bin/mksh/check.t,v 1.216 2008/07/14 12:29:04 tg Exp $
 # $OpenBSD: bksl-nl.t,v 1.2 2001/01/28 23:04:56 niklas Exp $
 # $OpenBSD: history.t,v 1.5 2001/01/28 23:04:56 niklas Exp $
 # $OpenBSD: read.t,v 1.3 2003/03/10 03:48:16 david Exp $
@@ -7,7 +7,7 @@
 # http://www.research.att.com/~gsf/public/ifs.sh
 
 expected-stdout:
-	@(#)MIRBSD KSH R35 2008/07/12
+	@(#)MIRBSD KSH R35 2008/07/14
 description:
 	Check version of shell.
 stdin:
@@ -3843,6 +3843,18 @@ expected-stdout:
 	FNORD_H=8
 	FNORD-8
 ---
+name: regression-64
+description:
+	Check that we can redefine functions calling time builtin
+stdin:
+	t() {
+		time >/dev/null
+	}
+	t 2>/dev/null
+	t() {
+		time
+	}
+---
 name: syntax-1
 description:
 	Check that lone ampersand is a syntax error
diff --git a/funcs.c b/funcs.c
index 4170650..1549061 100644
--- a/funcs.c
+++ b/funcs.c
@@ -5,7 +5,7 @@
 
 #include "sh.h"
 
-__RCSID("$MirOS: src/bin/mksh/funcs.c,v 1.84 2008/07/12 16:56:39 tg Exp $");
+__RCSID("$MirOS: src/bin/mksh/funcs.c,v 1.85 2008/07/14 12:29:05 tg Exp $");
 
 /* A leading = means assignments before command are kept;
  * a leading * means a POSIX special builtin;
@@ -2209,7 +2209,6 @@ timex(struct op *t, int f)
 	int rv = 0, tf = 0;
 	struct rusage ru0, ru1, cru0, cru1;
 	struct timeval usrtime, systime, tv0, tv1;
-	char opts[1];
 
 	gettimeofday(&tv0, NULL);
 	getrusage(RUSAGE_SELF, &ru0);
@@ -2225,11 +2224,8 @@ timex(struct op *t, int f)
 		 */
 		timerclear(&j_usrtime);
 		timerclear(&j_systime);
-		if (t->left->type == TCOM)
-			t->left->str = opts;
-		opts[0] = 0;
 		rv = execute(t->left, f | XTIME);
-		tf |= opts[0];
+		tf |= t->left->str[0];
 		gettimeofday(&tv1, NULL);
 		getrusage(RUSAGE_SELF, &ru1);
 		getrusage(RUSAGE_CHILDREN, &cru1);
diff --git a/sh.h b/sh.h
index 613a481..48e8e33 100644
--- a/sh.h
+++ b/sh.h
@@ -100,9 +100,9 @@
 #define __SCCSID(x)	__IDSTRING(sccsid,x)
 
 #ifdef EXTERN
-__RCSID("$MirOS: src/bin/mksh/sh.h,v 1.227 2008/07/12 18:09:37 tg Exp $");
+__RCSID("$MirOS: src/bin/mksh/sh.h,v 1.228 2008/07/14 12:29:06 tg Exp $");
 #endif
-#define MKSH_VERSION "R35 2008/07/12"
+#define MKSH_VERSION "R35 2008/07/14"
 
 #ifndef MKSH_INCLUDES_ONLY
 
diff --git a/syn.c b/syn.c
index e9dc635..3929f16 100644
--- a/syn.c
+++ b/syn.c
@@ -2,7 +2,7 @@
 
 #include "sh.h"
 
-__RCSID("$MirOS: src/bin/mksh/syn.c,v 1.23 2008/07/12 16:56:40 tg Exp $");
+__RCSID("$MirOS: src/bin/mksh/syn.c,v 1.24 2008/07/14 12:29:06 tg Exp $");
 
 struct nesting_state {
 	int start_token;	/* token than began nesting (eg, FOR) */
@@ -411,6 +411,11 @@ get_command(int cf)
 	case TIME:
 		syniocf &= ~(KEYWORD|ALIAS);
 		t = pipeline(0);
+		if (t) {
+			t->str = alloc(2, ATEMP);
+			t->str[0] = 0;	/* TF_* flags */
+			t->str[1] = '\0';
+		}
 		t = block(TTIME, t, NOBLOCK, NOWORDS);
 		break;