diff options
| author | Brian Foley | 2019-01-01 13:40:58 -0800 |
|---|---|---|
| committer | Denys Vlasenko | 2019-01-21 12:55:49 +0100 |
| commit | dac15a10accc6921d1559d254ceed9fe9d092ddf (patch) | |
| tree | 2c0082d5b5b03df07d26d048c587fdae0a22700c /editors | |
| parent | 11cb9eeffec0e2575c8722e83de3116f81b61b4f (diff) | |
| download | busybox-dac15a10accc6921d1559d254ceed9fe9d092ddf.zip busybox-dac15a10accc6921d1559d254ceed9fe9d092ddf.tar.gz | |
awk: Guard pointer chasing when parsing ternary expressions.
Avoids an uninit pointer deref for some malformed ternary exprs.
Add a test that would crash in busybox before this fix.
Signed-off-by: Brian Foley <bpfoley@google.com>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Diffstat (limited to 'editors')
| -rw-r--r-- | editors/awk.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/editors/awk.c b/editors/awk.c index b6d8cf2..f2b8b13 100644 --- a/editors/awk.c +++ b/editors/awk.c @@ -1265,7 +1265,7 @@ static node *parse_expr(uint32_t iexp) debug_printf_parse("%s(%x)\n", __func__, iexp); sn.info = PRIMASK; - sn.r.n = glptr = NULL; + sn.r.n = sn.a.n = glptr = NULL; xtc = TC_OPERAND | TC_UOPPRE | TC_REGEXP | iexp; while (!((tc = next_token(xtc)) & iexp)) { @@ -1287,6 +1287,7 @@ static node *parse_expr(uint32_t iexp) || ((t_info == vn->info) && ((t_info & OPCLSMASK) == OC_COLON)) ) { vn = vn->a.n; + if (!vn->a.n) syntax_error(EMSG_UNEXP_TOKEN); } if ((t_info & OPCLSMASK) == OC_TERNARY) t_info += P(6); |