[PATCH] expand: Do not call rmescapes in expari

Aleksander Ushakov <[email protected]> wrote:
> 
> ==19757==ERROR: AddressSanitizer: heap-buffer-overflow on address 
> 0x515000000500 at pc 0x6187826bab84 bp 0x7ffff71dca90 sp 0x7ffff71dca88
> READ of size 1 at 0x515000000500 thread T0
>     #0 0x6187826bab83 in _rmescapes /upstream/dash/src/expand.c:2088:9
>     #1 0x6187826bc389 in expari /upstream/dash/src/expand.c:517:3

Thanks for the report!

Indeed this rmescapes is completely unnecessary, which is why it
leads to the buffer overrun.  At this point characters are not
escaped at all.  The rmescapes call is a remnant from times when
argstr wasn't used by expari to generate the string.

---8<---
Remove the rmescapes call from expari as the string produced by
the recursive argstr call is not escaped.

Link: https://lore.kernel.org/dash/[email protected]/
Fixes: 3cd538634f71 ("expand: Do not reprocess data when expanding words")
Reported-by: Aleksander Ushakov <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

diff --git a/src/expand.c b/src/expand.c
index 25df03c..35481d6 100644
--- a/src/expand.c
+++ b/src/expand.c
@@ -513,9 +513,6 @@ static char *expari(char *start, int flag)
 
 	removerecordregions(begoff);
 
-	if (likely(flag & QUOTES_ESC))
-		rmescapes(start);
-
 	pushstackmark(&sm, endoff);
 	result = arith(start);
 	popstackmark(&sm);
-- 
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt