From fa52ac9781f479de8ab4d8526276244c0a0471f4 Mon Sep 17 00:00:00 2001 From: Sören Tempel Date: Mon, 28 Feb 2022 08:36:50 +0100 Subject: ash: don't read past end of var in subvareval for bash substitutions Without this patch, BusyBox handles bash pattern substitutions without a terminating '/' character incorrectly. Consider the following shell script: _bootstrapver=5.0.211-r0 _referencesdir="/usr/${_bootstrapver/-*}/Sources" echo $_referencesdir This should output `/usr/5.0.211/Sources`. However, without this patch it instead outputs `/usr/5.0.211Sources`. This is due to the fact that BusyBox expects the bash pattern substitutions to always be terminated with a '/' (at least in this part of subvareval) and thus reads passed the substitution itself and consumes the '/' character which is part of the literal string. If there is no '/' after the substitution then BusyBox might perform an out-of-bounds read under certain circumstances. When replacing the bash pattern substitution with `${_bootstrapver/-*/}`, or with this patch applied, ash outputs the correct value. Signed-off-by: Sören Tempel Signed-off-by: Denys Vlasenko --- shell/hush_test/hush-vars/var_bash_repl_unterminated.tests | 2 ++ 1 file changed, 2 insertions(+) create mode 100755 shell/hush_test/hush-vars/var_bash_repl_unterminated.tests (limited to 'shell/hush_test/hush-vars/var_bash_repl_unterminated.tests') diff --git a/shell/hush_test/hush-vars/var_bash_repl_unterminated.tests b/shell/hush_test/hush-vars/var_bash_repl_unterminated.tests new file mode 100755 index 0000000..c951334 --- /dev/null +++ b/shell/hush_test/hush-vars/var_bash_repl_unterminated.tests @@ -0,0 +1,2 @@ +a=b-c +echo ${a/-*}/d -- cgit v1.1