diff mbox

Fix for BZ #18043 buffer-overflow (read past the end) in wordexp/parse_dollars/parse_param

Message ID CALoOobMubkj2ikTiz+H0vKcYLUnLK=o-redAo27HOrwcGfeDRg@mail.gmail.com
State Committed
Headers

Commit Message

Paul Pluzhnikov Feb. 28, 2015, 2:47 a.m. UTC 
  Greetings,

Attached patch fixes BZ #18043.

TIL: strchr("abc", '\0') != NULL and that is apparently well defined.


2015-02-27  Paul Pluzhnikov  <ppluzhnikov@google.com>

        [BZ #18043]
        * posix/wordexp.c (parse_param): Fix buffer overflow.
        * posix/wordexp-test.c: Add test case.

Comments

Carlos O'Donell March 5, 2015, 7:48 p.m. UTC | #1 
On 02/27/2015 09:47 PM, Paul Pluzhnikov wrote:
> Greetings,
> 
> Attached patch fixes BZ #18043.
> 
> TIL: strchr("abc", '\0') != NULL and that is apparently well defined.
> 
> 
> 2015-02-27  Paul Pluzhnikov  <ppluzhnikov@google.com>
> 
>         [BZ #18043]
>         * posix/wordexp.c (parse_param): Fix buffer overflow.
>         * posix/wordexp-test.c: Add test case.
> 

Looks good to me. Thanks for fixing these and adding a test case.

OK to commit as long as you verified that test case fails before
and passes afterwards on at least x86_64.

Cheers,
Carlos.
diff mbox

Patch

diff --git a/posix/wordexp-test.c b/posix/wordexp-test.c
index 8a312e0..7690360 100644
--- a/posix/wordexp-test.c
+++ b/posix/wordexp-test.c
@@ -232,6 +232,9 @@  struct test_case_struct
     { WRDE_CMDSUB, NULL, "$((1+`echo 1`))", WRDE_NOCMD, 0, { NULL, }, IFS },
     { WRDE_CMDSUB, NULL, "$((1+$((`echo 1`))))", WRDE_NOCMD, 0, { NULL, }, IFS },
 
+    /* BZ # 18043 */
+    { WRDE_SYNTAX, NULL, "${", 0, 0, { NULL, }, IFS },
+
     { -1, NULL, NULL, 0, 0, { NULL, }, IFS },
   };
 
diff --git a/posix/wordexp.c b/posix/wordexp.c
index e3d8d6b..1c14401 100644
--- a/posix/wordexp.c
+++ b/posix/wordexp.c
@@ -1299,7 +1299,7 @@  parse_param (char **word, size_t *word_length, size_t *max_length,
 	}
       while (isdigit(words[++*offset]));
     }
-  else if (strchr ("*@$", words[*offset]) != NULL)
+  else if (words[*offset] != '\0' && strchr ("*@$", words[*offset]) != NULL)
     {
       /* Special parameter. */
       special = 1;