• use wdcopy() not str_save() to duplicate an “encoded string”, whatever

• prevent out-of-bounds memory access, cought by glibc malloc on IA-64
This commit is contained in:
tg 2007-03-14 02:41:09 +00:00
parent dbf38a152d
commit 7071cada42
3 changed files with 8 additions and 7 deletions

View File

@ -1,4 +1,4 @@
# $MirOS: src/bin/mksh/check.t,v 1.93 2007/03/10 00:42:00 tg Exp $
# $MirOS: src/bin/mksh/check.t,v 1.94 2007/03/14 02:41:08 tg Exp $
# $OpenBSD: bksl-nl.t,v 1.2 2001/01/28 23:04:56 niklas Exp $
# $OpenBSD: history.t,v 1.5 2001/01/28 23:04:56 niklas Exp $
# $OpenBSD: read.t,v 1.3 2003/03/10 03:48:16 david Exp $
@ -7,7 +7,7 @@
# http://www.research.att.com/~gsf/public/ifs.sh
expected-stdout:
@(#)MIRBSD KSH R29 2007/03/10
@(#)MIRBSD KSH R29 2007/03/14
description:
Check version of shell.
category: pdksh

7
eval.c
View File

@ -2,7 +2,7 @@
#include "sh.h"
__RCSID("$MirOS: src/bin/mksh/eval.c,v 1.24 2007/03/04 03:04:24 tg Exp $");
__RCSID("$MirOS: src/bin/mksh/eval.c,v 1.25 2007/03/14 02:41:08 tg Exp $");
#ifdef MKSH_SMALL
#define MKSH_NOPWNAM
@ -279,10 +279,11 @@ expand(const char *cp, /* input word */
char *beg, *end, *str;
sp = varname - 2; /* restore sp */
end = (beg = str_save(sp, ATEMP)) +
end = (beg = wdcopy(sp, ATEMP)) +
(wdscan(sp, CSUBST) - sp);
/* ({) the } or x is already skipped */
*end = EOS;
if (end < wdscan(beg, EOS))
*end = EOS;
str = snptreef(NULL, 64, "%S", beg);
afree(beg, ATEMP);
errorf("%s: bad substitution", str);

4
sh.h
View File

@ -8,8 +8,8 @@
/* $OpenBSD: c_test.h,v 1.4 2004/12/20 11:34:26 otto Exp $ */
/* $OpenBSD: tty.h,v 1.5 2004/12/20 11:34:26 otto Exp $ */
#define MKSH_SH_H_ID "$MirOS: src/bin/mksh/sh.h,v 1.120 2007/03/10 18:16:27 tg Exp $"
#define MKSH_VERSION "R29 2007/03/10"
#define MKSH_SH_H_ID "$MirOS: src/bin/mksh/sh.h,v 1.121 2007/03/14 02:41:09 tg Exp $"
#define MKSH_VERSION "R29 2007/03/14"
#if HAVE_SYS_PARAM_H
#include <sys/param.h>