Re: [PATCH 1/2] expand: Fix negative size parameter to memmove in subevalvar()

Zurab Kvachadze <[email protected]> wrote:
> A bug was reported on the mailing list that causes dash to segfault on
> the following cmdline:
> 
>        dash -c 'echo test > "${1%.in}"' sh /tmp/META.in
> 
> This is caused by a memory corruption resulting from a bug in
> scanright(). The function returns a pointer to string A, but later in
> subevalvar() that pointer is subtracted from the base of string B (which
> address is less than the address of A's substring). This produces a
> negative integer which is later happily passed as a parameter to
> memmove. The correct behaviour for the function is to return a pointer
> to a substring of string B.
> 
> This erroneous behaviour is caused by the fact that under certain
> conditions (FNMATCH_IS_ENABLED being undefined) scanright() iterates
> over the pattern string (that the string A in the example above - startp
> in the function), when it is meant to iterate over the string with
> removed escapes (string B - rmesc in the function).
> 
> Due to the fact that if FNMATCH_IS_ENABLED is undefined, each for loop
> iteration sets loc2 (initially pointing to str. B's end - rmescend) to
> loc (initially pointing to str. A's end - endp), which is not the
> desired behaviour.
> 
> This commit slightly changes the for loop header to make its behaviour
> correct for any value of FNMATCH_IS_ENABLED, thus fixing the root issue.
> 
> Fixes: https://lore.kernel.org/dash/CWLP265MB4157446AD56C013BB88575CFBCA82@CWLP265MB4157.GBRP265.PROD.OUTLOOK.COM/
> Reported-by: Kate Deplaix
> Signed-off-by: Zurab Kvachadze <[email protected]>
> ---
> src/expand.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)

Thanks, but I think this is already fixed by:

https://patchwork.kernel.org/project/dash/patch/[email protected]/

Cheers,
-- 
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt