[PATCH] builtin: Fix argv overrun in aexpr and oexpr

Aleksander Ushakov <[email protected]> wrote:
>
> I think I fixed the problem here:

Thanks for the report.  I think the following patch should fix
it too:

---8<---
Abort aexpr and oexpr if t_wp hits a NULL at the start.

Link: https://lore.kernel.org/dash/[email protected]/
Reported-by: Aleksander Ushakov <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

diff --git a/src/bltin/test.c b/src/bltin/test.c
index 6d844f1..4a3b86c 100644
--- a/src/bltin/test.c
+++ b/src/bltin/test.c
@@ -250,6 +250,8 @@ oexpr(enum token n)
 
 	for (;;) {
 		res |= aexpr(n);
+		if (!*t_wp)
+			break;
 		n = t_lex(t_wp + 1);
 		if (n != BOR)
 			break;
@@ -266,6 +268,8 @@ aexpr(enum token n)
 	for (;;) {
 		if (!nexpr(n))
 			res = 0;
+		if (!*t_wp)
+			break;
 		n = t_lex(t_wp + 1);
 		if (n != BAND)
 			break;
-- 
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt