From e368d851e78a2eb2aee50b8bad29dcc301feec65 Mon Sep 17 00:00:00 2001 From: Denys Vlasenko Date: Sun, 16 Feb 2020 19:02:22 +0100 Subject: [PATCH] ash: eval: Use the correct expansion mode for fd redirection Upstream comment: Date: Mon, 19 Nov 2018 18:00:32 +0800 eval: Use the correct expansion mode for fd redirection It has been reported that echo test >&$EMPTY_VARIABLE causes dash to segfault. This is a symptom of the bigger problem that dash tries to perform pathname expansion as well as field splitting on the word after >& and <&. This is wrong and this patch fixes it to use the same expansions as done on a normal redirection. Reported-by: Andrej Shadura Signed-off-by: Herbert Xu Signed-off-by: Denys Vlasenko --- shell/ash.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/shell/ash.c b/shell/ash.c index 97c7f4ef5..a43b65680 100644 --- a/shell/ash.c +++ b/shell/ash.c @@ -9445,11 +9445,10 @@ expredir(union node *n) case NFROMFD: case NTOFD: /* >& */ if (redir->ndup.vname) { - expandarg(redir->ndup.vname, &fn, EXP_FULL | EXP_TILDE); + expandarg(redir->ndup.vname, &fn, EXP_TILDE | EXP_REDIR); if (fn.list == NULL) ash_msg_and_raise_error("redir error"); #if BASH_REDIR_OUTPUT -//FIXME: we used expandarg with different args! if (!isdigit_str9(fn.list->text)) { /* >&file, not >&fd */ if (redir->nfile.fd != 1) /* 123>&file - BAD */