Re: [PATCH] ash: fix out-of-bounds read in ifsbreakup()

On 6/16/26 18:55, Harald van Dijk wrote:
> This was fixed differently in dash (where busybox ash comes from),
> instead they make sure ifsfree() is also called on error, see
> <https://kernel.googlesource.com/pub/scm/utils/dash/dash/+/9036ee8d7140f9f34988f00468dda94a69ace8f6>.
> It might be easier and reduce future conflicts to apply that to busybox
> instead?

Yes, I think you are right. The approach you pointed to fixes the root cause,
so I will use that for v3.

I checked ash for the same catch-EXERROR-and-continue pattern. There are
three such sites in total: redirectsafe(), expandstr(), and evaltree().
I will send a v3 that patches them together.

Thanks,
Sanghyun