[PATCH] parser: Fix USTPUTC overflow for new-style command substition here-doc marker

On Fri, Aug 29, 2025 at 07:40:16PM -0700, Nathan Mills wrote:
>
> * Crash #70 is a global-buffer-overflow caused by trying to place the
> closing parenthesis in the buffer stacknxt when there is not enough
> space (out points to stacknxt+512 and it tries to append character
> #513) during an attempt to read an input with an unclosed $()
> backtick.
>
> ** Crash #70 global-buffer-overflow **
> 
> Base64'd
> djR0bm9lITw8XDwkZGViXGd3JHd4ZWMkAIEkAiQzZSQoXAopITw8XDwkf3ckd3hlY1MAgSQCJDNl
> JChcCilcZ3ckd3hlYySMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMAIEkAiQzZSQoXAopKQ==
> 
> FIX for #70:
> diff --git a/src/parser.c b/src/parser.c
> index aecc18f..d3b598b 100644
> --- a/src/parser.c
> +++ b/src/parser.c
> @@ -1616,6 +1616,7 @@ done:
>         } else {
>                 if (chkeofmark) {
>                         out = commandtextcont(n, out);
> +                       CHECKSTRSPACE(1, out);
>                         USTPUTC(')', out);
>                 }
>                 goto parsebackq_newreturn;

Thanks for the report.  That USTPUTC should be a STPUTC.

---8<---
Use STPUTC after aommdntextcont when parsing a new-style command
substitution used as a here-document marker.

Reported-by: Nathan Mills <[email protected]>
Fixes: 7a11b3e330a3 ("parser: Extend coverage of CHKEOFMARK")
Signed-off-by: Herbert Xu <[email protected]>

diff --git a/src/parser.c b/src/parser.c
index a3b004b..488adfd 100644
--- a/src/parser.c
+++ b/src/parser.c
@@ -1616,7 +1616,7 @@ done:
 	} else {
 		if (chkeofmark) {
 			out = commandtextcont(n, out);
-			USTPUTC(')', out);
+			STPUTC(')', out);
 		}
 		goto parsebackq_newreturn;
 	}
-- 
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt