[PATCH] builtin: Fix read overflow in umaskcmd

Aleksander Ushakov <[email protected]> wrote:
>
> umask -S u=rwx,g good=r FOR A PARTICULAR PURPOSE.  See the

This is the minimal reproducer.

Thanks,

---8<---
If the first character after ugw is NUL, emit an error immediately
instead of continuing to read past the NUL.

Reported-by: Aleksander Ushakov <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

diff --git a/src/miscbltin.c b/src/miscbltin.c
index 5aa2b24..e66666c 100644
--- a/src/miscbltin.c
+++ b/src/miscbltin.c
@@ -274,7 +274,10 @@ umaskcmd(int argc, char **argv)
 					}
 				if (!positions)
 					positions = 0111; /* default is a */
-				if (!strchr("=+-", op = *ap))
+				op = *ap;
+				if (!op)
+					goto error;
+				if (!strchr("=+-", op))
 					break;
 				ap++;
 				new_val = 0;
@@ -314,6 +317,7 @@ umaskcmd(int argc, char **argv)
 					break;
 			}
 			if (*ap) {
+error:
 				sh_error("Illegal mode: %s", *argptr);
 				return 1;
 			}
-- 
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt