diff options
| author | Karsten Sperling | 2023-05-18 16:47:49 +0200 |
|---|---|---|
| committer | Denys Vlasenko | 2023-05-18 16:49:54 +0200 |
| commit | 3e83699ce23400d75c7ddaa7ebfdec015177caa7 (patch) | |
| tree | 25a58abe8809a5df3a6e73a08c8b7887804772db /shell/ash.c | |
| parent | c5682813abb2f24a7ab026c905af73eea58cb621 (diff) | |
| download | busybox-3e83699ce23400d75c7ddaa7ebfdec015177caa7.zip busybox-3e83699ce23400d75c7ddaa7ebfdec015177caa7.tar.gz | |
ash: use-after-free in bash pattern substitution
Commit daa66ed6 fixed a number of use-after-free bugs in bash pattern
substitution, however one "unguarded" STPUTC remained, which is fixed here.
function old new delta
subevalvar 1564 1576 +12
Signed-off-by: Karsten Sperling <ksperling@apple.com>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Diffstat (limited to 'shell/ash.c')
| -rw-r--r-- | shell/ash.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/shell/ash.c b/shell/ash.c index d2c5c5d..51b627f 100644 --- a/shell/ash.c +++ b/shell/ash.c @@ -7370,6 +7370,8 @@ subevalvar(char *start, char *str, int strloc, char *restart_detect = stackblock(); if (quotes && *loc == '\\') { STPUTC(CTLESC, expdest); + if (stackblock() != restart_detect) + goto restart; len++; } STPUTC(*loc, expdest); |