summaryrefslogtreecommitdiff
path: root/shell
diff options
context:
space:
mode:
authorDenis Vlasenko2007-05-06 14:15:42 +0000
committerDenis Vlasenko2007-05-06 14:15:42 +0000
commit21f0d4c55eceaf24f4f7e2b679032c55a104f1ac (patch)
tree347ba6d74433880a93084613329f2bf1baf0839b /shell
parentb952835efe865a8303f69d7fdac75c7dc11265ce (diff)
downloadbusybox-21f0d4c55eceaf24f4f7e2b679032c55a104f1ac.zip
busybox-21f0d4c55eceaf24f4f7e2b679032c55a104f1ac.tar.gz
hush: fix double-free in "echo TEST &"
Diffstat (limited to 'shell')
-rw-r--r--shell/README19
-rw-r--r--shell/hush.c183
2 files changed, 123 insertions, 79 deletions
diff --git a/shell/README b/shell/README
index 284c691..d492671 100644
--- a/shell/README
+++ b/shell/README
@@ -1,7 +1,24 @@
Various bits of what is known about busybox shells, in no particular order.
+2006-05-06
+hush: more bugs spotted. Comparison with bash:
+bash-3.2# echo "TEST`date;echo;echo`BEST"
+TESTSun May 6 09:21:05 CEST 2007BEST [we dont strip eols]
+bash-3.2# echo "TEST`echo '$(echo ZZ)'`BEST"
+TEST$(echo ZZ)BEST [we execute inner echo]
+bash-3.2# echo "TEST`echo "'"`BEST"
+TEST'BEST [we totally mess up this one]
+bash-3.2# echo `sleep 5`
+[Ctrl-C should work, Ctrl-Z should do nothing][we totally mess up this one]
+bash-3.2# if true; then
+> [Ctrl-C]
+bash-3.2# [we re-issue "> "]
+bash-3.2# if echo `sleep 5`; then
+> true; fi [we execute sleep before "> "]
+
2007-05-04
-hush: make ctrl-Z/C work correctly for "while true; do true; done"
+hush: made ctrl-Z/C work correctly for "while true; do true; done"
+(namely, it backgrounds/interrupts entire "while")
2007-05-03
hush: new bug spotted: Ctrl-C on "while true; do true; done" doesn't
diff --git a/shell/hush.c b/shell/hush.c
index a299b01..7afcfbd 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -87,34 +87,37 @@
* to perform debug printfs to stderr: */
#define debug_printf(...) do {} while (0)
/* Finer-grained debug switches */
-#define debug_printf_jobs(...) do {} while (0)
-#define debug_printf_exec(...) do {} while (0)
#define debug_printf_parse(...) do {} while (0)
#define debug_print_tree(a, b) do {} while (0)
-
+#define debug_printf_exec(...) do {} while (0)
+#define debug_printf_jobs(...) do {} while (0)
+#define debug_printf_clean(...) do {} while (0)
#ifndef debug_printf
#define debug_printf(...) fprintf(stderr, __VA_ARGS__)
-/* broken, of course, but OK for testing */
-static const char *indenter(int i)
-{
- static const char blanks[] = " ";
- return &blanks[sizeof(blanks) - i - 1];
-}
#endif
-#define final_printf debug_printf
-#ifndef debug_printf_jobs
-#define debug_printf_jobs(...) fprintf(stderr, __VA_ARGS__)
-#define DEBUG_SHELL_JOBS 1
+#ifndef debug_printf_parse
+#define debug_printf_parse(...) fprintf(stderr, __VA_ARGS__)
#endif
#ifndef debug_printf_exec
#define debug_printf_exec(...) fprintf(stderr, __VA_ARGS__)
#endif
-#ifndef debug_printf_parse
-#define debug_printf_parse(...) fprintf(stderr, __VA_ARGS__)
+#ifndef debug_printf_jobs
+#define debug_printf_jobs(...) fprintf(stderr, __VA_ARGS__)
+#define DEBUG_SHELL_JOBS 1
+#endif
+
+#ifndef debug_printf_clean
+/* broken, of course, but OK for testing */
+static const char *indenter(int i)
+{
+ static const char blanks[] = " ";
+ return &blanks[sizeof(blanks) - i - 1];
+}
+#define debug_printf_clean(...) fprintf(stderr, __VA_ARGS__)
#endif
@@ -281,7 +284,7 @@ static unsigned last_bg_pid;
enum { interactive_fd = 0 };
#else
/* 'interactive_fd' is a fd# open to ctty, if we have one
- * _AND_ if we decided to mess with job control */
+ * _AND_ if we decided to act interactively */
static int interactive_fd;
#if ENABLE_HUSH_JOB
static pid_t saved_task_pgrp;
@@ -379,6 +382,7 @@ static void mark_open(int fd);
static void mark_closed(int fd);
static void close_all(void);
/* "run" the final data structures: */
+//TODO: remove indent argument from non-debug build!
static int free_pipe_list(struct pipe *head, int indent);
static int free_pipe(struct pipe *pi, int indent);
/* really run the final data structures: */
@@ -537,10 +541,6 @@ static void handler_ctrl_z(int sig)
if (pid < 0) /* can't fork. Pretend there were no ctrl-Z */
return;
ctrl_z_flag = 1;
-//vda: wrong!!
-// toplevel_list->running_progs = 1;
-// toplevel_list->stopped_progs = 0;
-//
if (!pid) { /* child */
setpgrp();
debug_printf_jobs("set pgrp for child %d ok\n", getpid());
@@ -555,9 +555,6 @@ static void handler_ctrl_z(int sig)
/* finish filling up pipe info */
toplevel_list->pgrp = pid; /* child is in its own pgrp */
toplevel_list->progs[0].pid = pid;
-//vda: wrong!!
-// toplevel_list->running_progs = 1;
-// toplevel_list->stopped_progs = 0;
/* parent needs to longjmp out of running nofork.
* we will "return" exitcode 0, with child put in background */
// as usual we can have all kinds of nasty problems with leaked malloc data here
@@ -1051,7 +1048,7 @@ static void cmdedit_set_initial_prompt(void)
PS1 = "\\w \\$ ";
#endif
}
-#endif
+#endif /* EDITING */
static const char* setup_prompt_string(int promptmode)
{
@@ -1075,13 +1072,11 @@ static const char* setup_prompt_string(int promptmode)
debug_printf("result %s\n", prompt_str);
return prompt_str;
}
-#endif /* ENABLE_HUSH_INTERACTIVE */
#if ENABLE_FEATURE_EDITING
static line_input_t *line_input_state;
#endif
-#if ENABLE_HUSH_INTERACTIVE
static int get_user_input(struct in_str *i)
{
static char the_command[ENABLE_FEATURE_EDITING ? BUFSIZ : 2];
@@ -1096,18 +1091,18 @@ static int get_user_input(struct in_str *i)
** atexit() handlers and other unwanted stuff to our
** child processes (rob@sysgo.de)
*/
- r = read_line_input(prompt_str, the_command, BUFSIZ, line_input_state);
+ r = read_line_input(prompt_str, the_command, BUFSIZ-1, line_input_state);
#else
fputs(prompt_str, stdout);
fflush(stdout);
the_command[0] = r = fgetc(i->file);
- the_command[1] = '\0';
+ /*the_command[1] = '\0'; - already is and never changed */
#endif
fflush(stdout);
i->p = the_command;
return r; /* < 0 == EOF. Not meaningful otherwise */
}
-#endif
+#endif /* INTERACTIVE */
/* This is the magic location that prints prompts
* and gets data back from the user */
@@ -1279,7 +1274,7 @@ static void pseudo_exec_argv(char **argv)
for (i = 0; is_assignment(argv[i]); i++) {
debug_printf("pid %d environment modification: %s\n",
getpid(), argv[i]);
- // FIXME: vfork case??
+// FIXME: vfork case??
p = insert_var_value(argv[i]);
putenv(strdup(p));
if (p != argv[i])
@@ -1342,6 +1337,7 @@ static void pseudo_exec(struct child_prog *child)
if (child->group) {
// FIXME: do not modify globals! Think vfork!
#if ENABLE_HUSH_INTERACTIVE
+ debug_printf_exec("pseudo_exec: setting interactive_fd=0\n");
interactive_fd = 0; /* crucial!!!! */
#endif
debug_printf_exec("pseudo_exec: run_list_real\n");
@@ -1365,7 +1361,7 @@ static const char *get_cmdtext(struct pipe *pi)
/* This is subtle. ->cmdtext is created only on first backgrounding.
* (Think "cat, <ctrl-z>, fg, <ctrl-z>, fg, <ctrl-z>...." here...)
- * On subsequent bg argv can be trashed, but we won't use it */
+ * On subsequent bg argv is trashed, but we won't use it */
if (pi->cmdtext)
return pi->cmdtext;
argv = pi->progs[0].argv;
@@ -1385,12 +1381,11 @@ static const char *get_cmdtext(struct pipe *pi)
p[-1] = '\0';
return pi->cmdtext;
}
-#endif
-#if ENABLE_HUSH_JOB
static void insert_bg_job(struct pipe *pi)
{
struct pipe *thejob;
+ int i;
/* Linear search for the ID of the job to use */
pi->jobid = 1;
@@ -1398,7 +1393,7 @@ static void insert_bg_job(struct pipe *pi)
if (thejob->jobid >= pi->jobid)
pi->jobid = thejob->jobid + 1;
- /* add thejob to the list of running jobs */
+ /* Add thejob to the list of running jobs */
if (!job_list) {
thejob = job_list = xmalloc(sizeof(*thejob));
} else {
@@ -1408,17 +1403,29 @@ static void insert_bg_job(struct pipe *pi)
thejob = thejob->next;
}
- /* physically copy the struct job */
+ /* Physically copy the struct job */
memcpy(thejob, pi, sizeof(struct pipe));
- thejob->progs = xmalloc(sizeof(pi->progs[0]) * pi->num_progs);
- memcpy(thejob->progs, pi->progs, sizeof(pi->progs[0]) * pi->num_progs);
+ thejob->progs = xzalloc(sizeof(pi->progs[0]) * pi->num_progs);
+ /* We cannot copy entire pi->progs[] vector! Double free()s will happen */
+ for (i = 0; i < pi->num_progs; i++) {
+// TODO: do we really need to have so many fields which are just dead weight
+// at execution stage?
+ thejob->progs[i].pid = pi->progs[i].pid;
+ //rest:
+ //char **argv; /* program name and arguments */
+ //struct pipe *group; /* if non-NULL, first in group or subshell */
+ //int subshell; /* flag, non-zero if group must be forked */
+ //struct redir_struct *redirects; /* I/O redirections */
+ //glob_t glob_result; /* result of parameter globbing */
+ //int is_stopped; /* is the program currently running? */
+ //struct pipe *family; /* pointer back to the child's parent pipe */
+ //int sp; /* number of SPECIAL_VAR_SYMBOL */
+ //int type;
+ }
thejob->next = NULL;
- /*seems to be wrong:*/
- /*thejob->running_progs = thejob->num_progs;*/
- /*thejob->stopped_progs = 0;*/
thejob->cmdtext = xstrdup(get_cmdtext(pi));
- /* we don't wait for background thejobs to return -- append it
+ /* We don't wait for background thejobs to return -- append it
to the list of backgrounded thejobs and leave it alone */
printf("[%d] %d %s\n", thejob->jobid, thejob->progs[0].pid, thejob->cmdtext);
last_bg_pid = thejob->progs[0].pid;
@@ -1451,7 +1458,7 @@ static void delete_finished_bg_job(struct pipe *pi)
free_pipe(pi, 0);
free(pi);
}
-#endif
+#endif /* JOB */
/* Checks to see if any processes have exited -- if they
have, figure out why and see if a job has completed */
@@ -1622,7 +1629,7 @@ static int run_pipe_real(struct pipe *pi)
int rcode;
const int single_fg = (pi->num_progs == 1 && pi->followup != PIPE_BG);
- debug_printf_exec("run_pipe_real start:\n");
+ debug_printf_exec("run_pipe_real start: single_fg=%d\n", single_fg);
nextin = 0;
#if ENABLE_HUSH_JOB
@@ -1724,7 +1731,7 @@ static int run_pipe_real(struct pipe *pi)
setup_redirects(child, squirrel);
debug_printf_exec(": run_nofork_applet '%s' '%s'...\n", argv[i], argv[i+1]);
save_nofork_data(&nofork_save);
- rcode = run_nofork_applet_prime(&nofork_save, a, argv);
+ rcode = run_nofork_applet_prime(&nofork_save, a, argv + i);
restore_redirects(squirrel);
debug_printf_exec("run_pipe_real return %d\n", rcode);
return rcode;
@@ -1742,7 +1749,10 @@ static int run_pipe_real(struct pipe *pi)
for (i = 0; i < pi->num_progs; i++) {
child = &(pi->progs[i]);
- debug_printf_exec(": pipe member '%s' '%s'...\n", child->argv[0], child->argv[1]);
+ if (child->argv)
+ debug_printf_exec(": pipe member '%s' '%s'...\n", child->argv[0], child->argv[1]);
+ else
+ debug_printf_exec(": pipe member with no argv\n");
/* pipes are inserted between pairs of commands */
if ((i + 1) < pi->num_progs) {
@@ -1833,8 +1843,8 @@ static void debug_print_tree(struct pipe *pi, int lvl)
static const char *PIPE[] = {
[PIPE_SEQ] = "SEQ",
[PIPE_AND] = "AND",
- [PIPE_OR ] = "OR",
- [PIPE_BG ] = "BG",
+ [PIPE_OR ] = "OR" ,
+ [PIPE_BG ] = "BG" ,
};
static const char *RES[] = {
[RES_NONE ] = "NONE" ,
@@ -1914,14 +1924,15 @@ static int run_list_real(struct pipe *pi)
if ((rpipe->r_mode == RES_IN || rpipe->r_mode == RES_FOR)
&& (rpipe->next == NULL)
) {
- syntax();
+ syntax(); /* unterminated FOR (no IN or no commands after IN) */
debug_printf_exec("run_list_real lvl %d return 1\n", level);
return 1;
}
- if ((rpipe->r_mode == RES_IN && rpipe->next->r_mode == RES_IN && rpipe->next->progs->argv != NULL)
+ if ((rpipe->r_mode == RES_IN && rpipe->next->r_mode == RES_IN && rpipe->next->progs[0].argv != NULL)
|| (rpipe->r_mode == RES_FOR && rpipe->next->r_mode != RES_IN)
) {
- syntax();
+ /* TODO: what is tested in the first condition? */
+ syntax(); /* 2nd: malformed FOR (not followed by IN) */
debug_printf_exec("run_list_real lvl %d return 1\n", level);
return 1;
}
@@ -1952,7 +1963,7 @@ static int run_list_real(struct pipe *pi)
* Remember this child as background job */
insert_bg_job(pi);
} else {
- /* ctrl-C. We just stop doing whatever we was doing */
+ /* ctrl-C. We just stop doing whatever we were doing */
putchar('\n');
}
rcode = 0;
@@ -2018,8 +2029,7 @@ static int run_list_real(struct pipe *pi)
continue;
}
/* insert new value from list for variable */
- if (pi->progs->argv[0])
- free(pi->progs->argv[0]);
+ free(pi->progs->argv[0]);
pi->progs->argv[0] = *list++;
pi->progs->glob_result.gl_pathv[0] = pi->progs->argv[0];
}
@@ -2045,16 +2055,21 @@ static int run_list_real(struct pipe *pi)
/* We only ran a builtin: rcode was set by the return value
* of run_pipe_real(), and we don't need to wait for anything. */
} else if (pi->followup == PIPE_BG) {
- /* XXX check bash's behavior with nontrivial pipes */
- /* XXX compute jobid */
- /* XXX what does bash do with attempts to background builtins? */
+ /* What does bash do with attempts to background builtins? */
+
+ /* Even bash 3.2 doesn't do that well with nested bg:
+ * try "{ { sleep 10; echo DEEP; } & echo HERE; } &".
+ * I'm considering NOT treating inner bgs as jobs -
+ * thus maybe "if (level == 1 && pi->followup == PIPE_BG)"
+ * above? */
#if ENABLE_HUSH_JOB
insert_bg_job(pi);
#endif
rcode = EXIT_SUCCESS;
} else {
#if ENABLE_HUSH_JOB
- if (interactive_fd) {
+ /* Paranoia, just "interactive_fd" should be enough */
+ if (level == 1 && interactive_fd) {
rcode = checkjobs_and_fg_shell(pi);
} else
#endif
@@ -2103,33 +2118,33 @@ static int free_pipe(struct pipe *pi, int indent)
if (pi->stopped_progs > 0)
return ret_code;
- final_printf("%s run pipe: (pid %d)\n", indenter(indent), getpid());
+ debug_printf_clean("%s run pipe: (pid %d)\n", indenter(indent), getpid());
for (i = 0; i < pi->num_progs; i++) {
child = &pi->progs[i];
- final_printf("%s command %d:\n", indenter(indent), i);
+ debug_printf_clean("%s command %d:\n", indenter(indent), i);
if (child->argv) {
for (a = 0, p = child->argv; *p; a++, p++) {
- final_printf("%s argv[%d] = %s\n", indenter(indent), a, *p);
+ debug_printf_clean("%s argv[%d] = %s\n", indenter(indent), a, *p);
}
globfree(&child->glob_result);
child->argv = NULL;
} else if (child->group) {
- final_printf("%s begin group (subshell:%d)\n", indenter(indent), child->subshell);
+ debug_printf_clean("%s begin group (subshell:%d)\n", indenter(indent), child->subshell);
ret_code = free_pipe_list(child->group, indent+3);
- final_printf("%s end group\n", indenter(indent));
+ debug_printf_clean("%s end group\n", indenter(indent));
} else {
- final_printf("%s (nil)\n", indenter(indent));
+ debug_printf_clean("%s (nil)\n", indenter(indent));
}
for (r = child->redirects; r; r = rnext) {
- final_printf("%s redirect %d%s", indenter(indent), r->fd, redir_table[r->type].descrip);
+ debug_printf_clean("%s redirect %d%s", indenter(indent), r->fd, redir_table[r->type].descrip);
if (r->dup == -1) {
/* guard against the case >$FOO, where foo is unset or blank */
if (r->word.gl_pathv) {
- final_printf(" %s\n", *r->word.gl_pathv);
+ debug_printf_clean(" %s\n", *r->word.gl_pathv);
globfree(&r->word);
}
} else {
- final_printf("&%d\n", r->dup);
+ debug_printf_clean("&%d\n", r->dup);
}
rnext = r->next;
free(r);
@@ -2149,10 +2164,11 @@ static int free_pipe_list(struct pipe *head, int indent)
{
int rcode = 0; /* if list has no members */
struct pipe *pi, *next;
+
for (pi = head; pi; pi = next) {
- final_printf("%s pipe reserved mode %d\n", indenter(indent), pi->r_mode);
+ debug_printf_clean("%s pipe reserved mode %d\n", indenter(indent), pi->r_mode);
rcode = free_pipe(pi, indent);
- final_printf("%s pipe followup code %d\n", indenter(indent), pi->followup);
+ debug_printf_clean("%s pipe followup code %d\n", indenter(indent), pi->followup);
next = pi->next;
/*pi->next = NULL;*/
free(pi);
@@ -2164,14 +2180,16 @@ static int free_pipe_list(struct pipe *head, int indent)
static int run_list(struct pipe *pi)
{
int rcode = 0;
+ debug_printf_exec("run_list entered\n");
if (fake_mode == 0) {
- debug_printf_exec("run_list: run_list_real with %d members\n", pi->num_progs);
+ debug_printf_exec(": run_list_real with %d members\n", pi->num_progs);
rcode = run_list_real(pi);
}
- /* free_pipe_list has the side effect of clearing memory
+ /* free_pipe_list has the side effect of clearing memory.
* In the long run that function can be merged with run_list_real,
* but doing that now would hobble the debugging effort. */
free_pipe_list(pi, 0);
+ debug_printf_exec("run_list return %d\n", rcode);
return rcode;
}
@@ -2201,7 +2219,7 @@ static int globhack(const char *src, int flags, glob_t *pglob)
pglob->gl_offs = 0;
}
pathc = ++pglob->gl_pathc;
- pglob->gl_pathv = realloc(pglob->gl_pathv, (pathc+1)*sizeof(*pglob->gl_pathv));
+ pglob->gl_pathv = realloc(pglob->gl_pathv, (pathc+1) * sizeof(*pglob->gl_pathv));
if (pglob->gl_pathv == NULL)
return GLOB_NOSPACE;
pglob->gl_pathv[pathc-1] = dest;
@@ -2821,8 +2839,7 @@ static FILE *generate_stream_from_list(struct pipe *head)
return pf;
}
-/* this version hacked for testing purposes */
-/* return code is exit status of the process that is run. */
+/* Return code is exit status of the process that is run. */
static int process_command_subs(o_string *dest, struct p_context *ctx,
struct in_str *input, const char *subst_end)
{
@@ -2843,9 +2860,19 @@ static int process_command_subs(o_string *dest, struct p_context *ctx,
p = generate_stream_from_list(inner.list_head);
if (p == NULL) return 1;
mark_open(fileno(p));
+// FIXME: need to flag pipe_str to somehow discard all trailing newlines.
+// Example: echo "TEST`date;echo;echo`BEST"
+// must produce one line: TEST<date>BEST
setup_file_in_str(&pipe_str, p);
/* now send results of command back into original context */
+// FIXME: must not do quote parsing of the output!
+// Example: echo "TEST`echo '$(echo ZZ)'`BEST"
+// must produce TEST$(echo ZZ)BEST, not TESTZZBEST.
+// Example: echo "TEST`echo "'"`BEST"
+// must produce TEST'BEST
+// (maybe by setting all chars flagged as literals in map[]?)
+
retcode = parse_stream(dest, ctx, &pipe_str, NULL);
/* XXX In case of a syntax error, should we try to kill the child?
* That would be tough to do right, so just read until EOF. */
@@ -2864,7 +2891,6 @@ static int process_command_subs(o_string *dest, struct p_context *ctx,
retcode = pclose(p);
free_pipe_list(inner.list_head, 0);
debug_printf("pclosed, retcode=%d\n", retcode);
- /* XXX this process fails to trim a single trailing newline */
return retcode;
}
@@ -2904,7 +2930,7 @@ static int parse_group(o_string *dest, struct p_context *ctx,
/* child remains "open", available for possible redirects */
}
-/* basically useful version until someone wants to get fancier,
+/* Basically useful version until someone wants to get fancier,
* see the bash man page under "Parameter Expansion" */
static const char *lookup_param(const char *src)
{
@@ -3272,8 +3298,8 @@ static int parse_stream_outer(struct in_str *inp, int parse_flag)
if (rcode != 1 && ctx.old_flag == 0) {
done_word(&temp, &ctx);
done_pipe(&ctx, PIPE_SEQ);
- debug_printf_exec("parse_stream_outer: run_list\n");
debug_print_tree(ctx.list_head, 0);
+ debug_printf_exec("parse_stream_outer: run_list\n");
run_list(ctx.list_head);
} else {
if (ctx.old_flag != 0) {
@@ -3392,7 +3418,7 @@ int hush_main(int argc, char **argv)
last_return_code = EXIT_SUCCESS;
if (argv[0] && argv[0][0] == '-') {
- debug_printf("\nsourcing /etc/profile\n");
+ debug_printf("sourcing /etc/profile\n");
input = fopen("/etc/profile", "r");
if (input != NULL) {
mark_open(fileno(input));
@@ -3455,12 +3481,13 @@ int hush_main(int argc, char **argv)
// to (inadvertently) close/redirect it
}
}
- debug_printf("\ninteractive_fd=%d\n", interactive_fd);
+ debug_printf("interactive_fd=%d\n", interactive_fd);
if (interactive_fd) {
/* Looks like they want an interactive shell */
setup_job_control();
/* Make xfuncs do cleanup on exit */
die_sleep = -1; /* flag */
+// FIXME: should we reset die_sleep = 0 whereever we fork?
if (setjmp(die_jmp)) {
/* xfunc has failed! die die die */
hush_exit(xfunc_error_retval);