summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorSören Tempel2022-02-28 08:36:50 +0100
committerDenys Vlasenko2022-03-01 08:47:43 +0100
commitfa52ac9781f479de8ab4d8526276244c0a0471f4 (patch)
treea1cf6cad888fa4e22dd160b334e53854562cba47
parent1891fdda59092a215d3a407d9108bbbe6ab8df7a (diff)
downloadbusybox-fa52ac9781f479de8ab4d8526276244c0a0471f4.zip
busybox-fa52ac9781f479de8ab4d8526276244c0a0471f4.tar.gz
ash: don't read past end of var in subvareval for bash substitutions
Without this patch, BusyBox handles bash pattern substitutions without a terminating '/' character incorrectly. Consider the following shell script: _bootstrapver=5.0.211-r0 _referencesdir="/usr/${_bootstrapver/-*}/Sources" echo $_referencesdir This should output `/usr/5.0.211/Sources`. However, without this patch it instead outputs `/usr/5.0.211Sources`. This is due to the fact that BusyBox expects the bash pattern substitutions to always be terminated with a '/' (at least in this part of subvareval) and thus reads passed the substitution itself and consumes the '/' character which is part of the literal string. If there is no '/' after the substitution then BusyBox might perform an out-of-bounds read under certain circumstances. When replacing the bash pattern substitution with `${_bootstrapver/-*/}`, or with this patch applied, ash outputs the correct value. Signed-off-by: Sören Tempel <soeren@soeren-tempel.net> Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
-rw-r--r--shell/ash.c4
-rw-r--r--shell/ash_test/ash-vars/var_bash_repl_unterminated.right1
-rwxr-xr-xshell/ash_test/ash-vars/var_bash_repl_unterminated.tests2
-rw-r--r--shell/hush_test/hush-vars/var_bash_repl_unterminated.right1
-rwxr-xr-xshell/hush_test/hush-vars/var_bash_repl_unterminated.tests2
5 files changed, 10 insertions, 0 deletions
diff --git a/shell/ash.c b/shell/ash.c
index adb0f22..54335c5 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -7081,6 +7081,10 @@ subevalvar(char *start, char *str, int strloc,
*repl = '\0';
break;
}
+ if ((unsigned char)*repl == CTLENDVAR) { /* ${v/pattern} (no trailing /, no repl) */
+ repl = NULL;
+ break;
+ }
/* Handle escaped slashes, e.g. "${v/\//_}" (they are CTLESC'ed by this point) */
if ((unsigned char)*repl == CTLESC && repl[1])
repl++;
diff --git a/shell/ash_test/ash-vars/var_bash_repl_unterminated.right b/shell/ash_test/ash-vars/var_bash_repl_unterminated.right
new file mode 100644
index 0000000..5bff3a6
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_bash_repl_unterminated.right
@@ -0,0 +1 @@
+b/d
diff --git a/shell/ash_test/ash-vars/var_bash_repl_unterminated.tests b/shell/ash_test/ash-vars/var_bash_repl_unterminated.tests
new file mode 100755
index 0000000..c951334
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_bash_repl_unterminated.tests
@@ -0,0 +1,2 @@
+a=b-c
+echo ${a/-*}/d
diff --git a/shell/hush_test/hush-vars/var_bash_repl_unterminated.right b/shell/hush_test/hush-vars/var_bash_repl_unterminated.right
new file mode 100644
index 0000000..5bff3a6
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_bash_repl_unterminated.right
@@ -0,0 +1 @@
+b/d
diff --git a/shell/hush_test/hush-vars/var_bash_repl_unterminated.tests b/shell/hush_test/hush-vars/var_bash_repl_unterminated.tests
new file mode 100755
index 0000000..c951334
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_bash_repl_unterminated.tests
@@ -0,0 +1,2 @@
+a=b-c
+echo ${a/-*}/d