diff options
| author | Denys Vlasenko | 2022-08-02 12:41:18 +0200 |
|---|---|---|
| committer | Denys Vlasenko | 2022-08-02 12:41:18 +0200 |
| commit | daa66ed62c79684219088cc0361d5b316d5d1295 (patch) | |
| tree | 45ea93d868cc86875bc4ab6998ff7a8e0e1677d0 /shell/ash.c | |
| parent | 1c5455284234e894dfb6086bf7f3e9a6d5d9611f (diff) | |
| download | busybox-daa66ed62c79684219088cc0361d5b316d5d1295.zip busybox-daa66ed62c79684219088cc0361d5b316d5d1295.tar.gz | |
ash: fix use-after-free in pattern substituon code
Patch by soeren@soeren-tempel.net
The idx variable points to a value in the stack string (as managed
by STPUTC). STPUTC may resize this stack string via realloc(3). If
this happens, the idx pointer needs to be updated. Otherwise,
dereferencing idx may result in a use-after free.
function old new delta
subevalvar 1562 1566 +4
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Diffstat (limited to 'shell/ash.c')
| -rw-r--r-- | shell/ash.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/shell/ash.c b/shell/ash.c index c731a33..105edd4 100644 --- a/shell/ash.c +++ b/shell/ash.c @@ -7324,13 +7324,15 @@ subevalvar(char *start, char *str, int strloc, if (idx >= end) break; STPUTC(*idx, expdest); + if (stackblock() != restart_detect) + goto restart; if (quotes && (unsigned char)*idx == CTLESC) { idx++; len++; STPUTC(*idx, expdest); + if (stackblock() != restart_detect) + goto restart; } - if (stackblock() != restart_detect) - goto restart; idx++; len++; rmesc++; |