Re: [PATCH] applying zero offset to null pointer growjobtab() src/jobs.c:819:34

31/07/25 21:12, Aleksander Ushakov wrote:
> Hello Dash maintainers,
> 
> I encountered a bug in Dash in commit b4ef25d7 and would like to report
> it. The details are provided below.
> 
> 
> jobs.c:819:34: runtime error: applying zero offset to null pointer
>      #0 0x5adb67991deb in growjobtab /upstream/ubsan/dash/src/jobs.c:819:34
>      #1 0x5adb67991985 in makejob /upstream/ubsan/dash/src/jobs.c:774:9
>      #2 0x5adb679937a8 in vforkexec /upstream/ubsan/dash/src/jobs.c:992:7
>      #3 0x5adb6796edcc in evalcommand /upstream/ubsan/dash/src/eval.c:916:9
>      #4 0x5adb6796c0ac in evaltree /upstream/ubsan/dash/src/eval.c:305:12
>      #5 0x5adb6799818c in cmdloop /upstream/ubsan/dash/src/main.c:246:8
>      #6 0x5adb67997e4b in main /upstream/ubsan/dash/src/main.c:180:3
>      #7 0x7a95463ad249 in __libc_start_call_main csu/../sysdeps/nptl/ 
> libc_start_call_main.h:58:16
>      #8 0x7a95463ad304 in __libc_start_main csu/../csu/libc-start.c:360:3
>      #9 0x5adb6793a930 in _start (/upstream/ubsan/dash/src/dash+0x42930) 
> (BuildId: bf877a87a1c989c4907f14ce16668321dedc5edd)
> 
> SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-offset jobs.c:819:34
> 
> Environment:
> 
> Debian-12, x86-64
> clang-19 compiler
> 
> Steps to reproduce:
> 
> ./autogen.sh
> CC=clang CFLAGS=" -fsanitize=undefined -g " ./configure --disable- 
> fnmatch --disable-lineno --disable-glob
> make
> cd src
> echo "sudo" | ./dash
> 
> You can put any installed utility instead of sudo on your system, except 
> builtin commands.

My patch looks like:

diff --git a/src/jobs.c b/src/jobs.c
index 51e6fa1..cd7bff7 100644
--- a/src/jobs.c
+++ b/src/jobs.c
@@ -815,8 +815,8 @@ growjobtab(void)
         if (offset) {
                 /* Relocate pointers */
                 size_t l = len;
-
-               jq = (struct job *)((char *)jq + l);
+               if (jq)
+                       jq = (struct job *)((char *)jq + l);
                 while (l) {
                         l -= sizeof(*jp);
                         jq--;

It fixes the runtime error, but I'm not sure how it affects the 
translator functionalty.