[PATCH] ash: use-after-free in bash pattern substitution (resubmit)

[Denys Vlasenko]

Applied, thank you.

On Mon, May 15, 2023 at 7:26 AM Karsten Sperling <ksperling at apple.com> wrote:
>
> Hi, just bumping this thread one last time.
>
> Please let me know if there is some contribution guideline I’m not following correctly, or if there is some other reason for not accepting this patch.
>
> Cheers, Karsten
>
>
> > On 18/04/2023, at 3:24 PM, Karsten Sperling <ksperling at apple.com> wrote:
> >
> > Commit daa66ed6 fixed a number of use-after-free bugs in bash pattern substitution, however one "unguarded" STPUTC remained, which is fixed here.
> >
> > Signed-off-by: Karsten Sperling <ksperling at apple.com>
> > ---
> > shell/ash.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/shell/ash.c b/shell/ash.c
> > index d2c5c5d50..51b627fcc 100644
> > --- a/shell/ash.c
> > +++ b/shell/ash.c
> > @@ -7370,6 +7370,8 @@ subevalvar(char *start, char *str, int strloc,
> >                                char *restart_detect = stackblock();
> >                                if (quotes && *loc == '\\') {
> >                                        STPUTC(CTLESC, expdest);
> > +                                       if (stackblock() != restart_detect)
> > +                                               goto restart;
> >                                        len++;
> >                                }
> >                                STPUTC(*loc, expdest);
> > --  2.39.0
> >
>
> _______________________________________________
> busybox mailing list
> busybox at busybox.net
> http://lists.busybox.net/mailman/listinfo/busybox