From 3e83699ce23400d75c7ddaa7ebfdec015177caa7 Mon Sep 17 00:00:00 2001
From: Karsten Sperling
Date: Thu, 18 May 2023 16:47:49 +0200
Subject: ash: use-after-free in bash pattern substitution

Commit daa66ed6 fixed a number of use-after-free bugs in bash pattern
substitution, however one "unguarded" STPUTC remained, which is fixed here.

function                                             old     new   delta
subevalvar                                          1564    1576     +12

Signed-off-by: Karsten Sperling <ksperling@apple.com>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
---
 shell/ash.c | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'shell/ash.c')

diff --git a/shell/ash.c b/shell/ash.c
index d2c5c5d..51b627f 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -7370,6 +7370,8 @@ subevalvar(char *start, char *str, int strloc,
 				char *restart_detect = stackblock();
 				if (quotes && *loc == '\\') {
 					STPUTC(CTLESC, expdest);
+					if (stackblock() != restart_detect)
+						goto restart;
 					len++;
 				}
 				STPUTC(*loc, expdest);
-- 
cgit v1.1