d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

sh: Don't create bad parse result when postponing a bad substitution error.

Browse Source 
An invalid substitution like ${var@} does not cause a parse error but is
stored in the intermediate representation, to be written as part of the
error message. If there is a CTL* byte in the stored part, this confuses
some code such as the code to skip an unused alternative such as in
${var-alternative}.

To keep things simple, do not store CTL* bytes.

Found with afl-fuzz.

MFC after:	1 week
This commit is contained in:
Jilles Tjoelker 2015-08-23 20:44:53 +00:00
parent 786e3c1bac
commit d0b0ac182d
4 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
bin/sh/parser.c
View File

@ -1662,7 +1662,7 @@ parsesub: {
pungetc();
else if (c == '\n' || c == PEOF)
synerror("Unexpected end of line in substitution");
else
else if (BASESYNTAX[c] != CCTL)
USTPUTC(c, out);
}
if (subtype == 0) {
@ -1678,7 +1678,8 @@ parsesub: {
synerror("Unexpected end of line in substitution");
if (flags == VSNUL)
STPUTC(':', out);
STPUTC(c, out);
if (BASESYNTAX[c] != CCTL)
STPUTC(c, out);
subtype = VSERROR;
} else
subtype = p - types + VSNORMAL;

2
bin/sh/tests/errors/Makefile
View File

@ -19,6 +19,8 @@ FILES+= bad-parm-exp3.2 bad-parm-exp3.2.stderr
FILES+= bad-parm-exp4.2 bad-parm-exp4.2.stderr
FILES+= bad-parm-exp5.2 bad-parm-exp5.2.stderr
FILES+= bad-parm-exp6.2 bad-parm-exp6.2.stderr
FILES+= bad-parm-exp7.0
FILES+= bad-parm-exp8.0
FILES+= option-error.0
FILES+= redirection-error.0
FILES+= redirection-error2.2

4
bin/sh/tests/errors/bad-parm-exp7.0 Normal file
View File

@ -0,0 +1,4 @@
# $FreeBSD$
v=1
eval ": $(printf '${v-${\372}}')"

4
bin/sh/tests/errors/bad-parm-exp8.0 Normal file
View File

@ -0,0 +1,4 @@
# $FreeBSD$
v=1
eval ": $(printf '${v-${w\372}}')"