[git commit] ash: eval: Use the correct expansion mode for fd redirection

[Denys Vlasenko]

commit: https://git.busybox.net/busybox/commit/?id=e368d851e78a2eb2aee50b8bad29dcc301feec65
branch: https://git.busybox.net/busybox/commit/?id=refs/heads/master

Upstream comment:

    Date: Mon, 19 Nov 2018 18:00:32 +0800
    eval: Use the correct expansion mode for fd redirection

    It has been reported that

            echo test >&$EMPTY_VARIABLE

    causes dash to segfault.  This is a symptom of the bigger problem
    that dash tries to perform pathname expansion as well as field
    splitting on the word after >& and <&.  This is wrong and this
    patch fixes it to use the same expansions as done on a normal
    redirection.

    Reported-by: Andrej Shadura <andrew.shadura at collabora.co.uk>
    Signed-off-by: Herbert Xu <herbert at gondor.apana.org.au>

Signed-off-by: Denys Vlasenko <vda.linux at googlemail.com>
---
 shell/ash.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/shell/ash.c b/shell/ash.c
index 97c7f4ef5..a43b65680 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -9445,11 +9445,10 @@ expredir(union node *n)
 		case NFROMFD:
 		case NTOFD: /* >& */
 			if (redir->ndup.vname) {
-				expandarg(redir->ndup.vname, &fn, EXP_FULL | EXP_TILDE);
+				expandarg(redir->ndup.vname, &fn, EXP_TILDE | EXP_REDIR);
 				if (fn.list == NULL)
 					ash_msg_and_raise_error("redir error");
 #if BASH_REDIR_OUTPUT
-//FIXME: we used expandarg with different args!
 				if (!isdigit_str9(fn.list->text)) {
 					/* >&file, not >&fd */
 					if (redir->nfile.fd != 1) /* 123>&file - BAD */