557482c1c
Denys Vlasenko
2016-09-25
Subject
ash: in heredoc code, fix access past the end of allocated memory. Closes 9276
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
shell/ash.c+18 -14
| @@ -5112,8 +5112,26 @@ openredirect(union node *redir) | |
| char *fname; | |
| int f; | |
| + | switch (redir->nfile.type) { |
| + | /* Can't happen, our single caller does this itself */ |
| + | // case NTOFD: |
| + | // case NFROMFD: |
| + | // return -1; |
| + | case NHERE: |
| + | case NXHERE: |
| + | return openhere(redir); |
| + | } |
| + | |
| + | /* For N[X]HERE, reading redir->nfile.expfname would touch beyond |
| + | * allocated space. Do it only when we know it is safe. |
| + | */ |
| fname = redir->nfile.expfname; | |
| + | |
| switch (redir->nfile.type) { | |
| + | default: |
| + | #if DEBUG |
| + | abort(); |
| + | #endif |
| case NFROM: | |
| f = open(fname, O_RDONLY); | |
| if (f < 0) | |
| @@ -5146,20 +5164,6 @@ openredirect(union node *redir) | |
| if (f < 0) | |
| goto ecreate; | |
| break; | |
| - | default: |
| - | #if DEBUG |
| - | abort(); |
| - | #endif |
| - | /* Fall through to eliminate warning. */ |
| - | /* Our single caller does this itself */ |
| - | // case NTOFD: |
| - | // case NFROMFD: |
| - | // f = -1; |
| - | // break; |
| - | case NHERE: |
| - | case NXHERE: |
| - | f = openhere(redir); |
| - | break; |
| } | |
| return f; | |