Re: [PATCH] ash: fix out-of-bounds read in ifsbreakup()

On 6/16/26 15:22, Harald van Dijk wrote:
> It should not be possible for the last byte in a recorded region to be
> an unescaped CTLESC. Do you have a test case for what this patch fixes?

Thanks, you are right. The CTLESC-at-the-end explanation was wrong for
this reproducer, and the extra CTLESC guards in my original patch were not
justified.

The issue I can reproduce is stale IFS region state. argstr() raises an
arithmetic syntax error after IFS regions have been recorded, and the
longjmp skips expandarg()'s final ifsfree(). A later expansion then reuses
the stack for a shorter string, while ifsbreakup() still walks the stale
offsets.

Test case:

  base64 -d > poc.sh <<'EOF'
  IyEvYmJiAS0tIGE6YjpjCmVjZSA8PCB2Yf+AYWJsZSBhbmQ7YUVPRgpoZW4KRU9cCmVjaG8AJC0t
  LS0tLS0tYjpjCiR7XzooKDdiACByZWEtLS1iOmMKJQskJCQIJCQkCCQkI3t9Ch0/Yw==
  EOF
  busybox ash poc.sh

With an ASAN build, this reports a heap-buffer-overflow in ifsbreakup():

  ERROR: AddressSanitizer: heap-buffer-overflow
  READ of size 1
  #0 ifsbreakup shell/ash.c:6463

So I will send a v2 that removes the CTLESC-specific claim and guards.
The v2 only caps each saved IFS region to the current stack block.

Thanks,
Sanghyun