emo/busybox
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ash: in heredoc code, fix access past the end of allocated memory. Closes 9276

Browse Source 
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
This commit is contained in:
Denys Vlasenko 2016-09-25 21:24:04 +02:00
parent 13f20919b2
commit 557482c1cb
1 changed files with 19 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
shell/ash.c
View File

@ -5112,8 +5112,26 @@ openredirect(union node *redir)
char *fname;
int f;
fname = redir->nfile.expfname;
switch (redir->nfile.type) {
/* Can't happen, our single caller does this itself */
// case NTOFD:
// case NFROMFD:
// return -1;
case NHERE:
case NXHERE:
return openhere(redir);
}
/* For N[X]HERE, reading redir->nfile.expfname would touch beyond
* allocated space. Do it only when we know it is safe.
*/
fname = redir->nfile.expfname;
switch (redir->nfile.type) {
default:
#if DEBUG
abort();
#endif
case NFROM:
f = open(fname, O_RDONLY);
if (f < 0)
@ -5146,20 +5164,6 @@ openredirect(union node *redir)
if (f < 0)
goto ecreate;
break;
default:
#if DEBUG
abort();
#endif
/* Fall through to eliminate warning. */
/* Our single caller does this itself */
// case NTOFD:
// case NFROMFD:
// f = -1;
// break;
case NHERE:
case NXHERE:
f = openhere(redir);
break;
}
return f;