Re: [PATCH] ash: fix out-of-bounds read in ifsbreakup()

On 16/06/2026 15:09, Sanghyun Park wrote:
> On 6/16/26 15:22, Harald van Dijk wrote:
>> It should not be possible for the last byte in a recorded region to be
>> an unescaped CTLESC. Do you have a test case for what this patch fixes?
> 
> Thanks, you are right. The CTLESC-at-the-end explanation was wrong for
> this reproducer, and the extra CTLESC guards in my original patch were not
> justified.
> 
> The issue I can reproduce is stale IFS region state. argstr() raises an
> arithmetic syntax error after IFS regions have been recorded, and the
> longjmp skips expandarg()'s final ifsfree(). A later expansion then reuses
> the stack for a shorter string, while ifsbreakup() still walks the stale
> offsets.

Ah, thanks for that explanation!

This was fixed differently in dash (where busybox ash comes from), 
instead they make sure ifsfree() is also called on error, see 
<https://kernel.googlesource.com/pub/scm/utils/dash/dash/+/9036ee8d7140f9f34988f00468dda94a69ace8f6>. 
It might be easier and reduce future conflicts to apply that to busybox 
instead?

Cheers,
Harald van Dijk