|
| 1 | +From d417193cf37ca1005830d7e16f5fa7e1d8a44209 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Denys Vlasenko <vda.linux@googlemail.com> |
| 3 | +Date: Mon, 12 Jun 2023 17:48:47 +0200 |
| 4 | +Subject: [PATCH] shell: avoid segfault on ${0::0/0~09J}. Closes 15216 |
| 5 | + |
| 6 | +function old new delta |
| 7 | +evaluate_string 1011 1053 +42 |
| 8 | + |
| 9 | +Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com> |
| 10 | +--- |
| 11 | + shell/math.c | 39 +++++++++++++++++++++++++++++++++++---- |
| 12 | + 1 file changed, 35 insertions(+), 4 deletions(-) |
| 13 | + |
| 14 | +diff --git a/shell/math.c b/shell/math.c |
| 15 | +index 76d22c9bd5..727c294674 100644 |
| 16 | +--- a/shell/math.c |
| 17 | ++++ b/shell/math.c |
| 18 | +@@ -577,6 +577,28 @@ static arith_t strto_arith_t(const char *nptr, char **endptr) |
| 19 | + # endif |
| 20 | + #endif |
| 21 | + |
| 22 | ++//TODO: much better estimation than expr_len/2? Such as: |
| 23 | ++//static unsigned estimate_nums_and_names(const char *expr) |
| 24 | ++//{ |
| 25 | ++// unsigned count = 0; |
| 26 | ++// while (*(expr = skip_whitespace(expr)) != '\0') { |
| 27 | ++// const char *p; |
| 28 | ++// if (isdigit(*expr)) { |
| 29 | ++// while (isdigit(*++expr)) |
| 30 | ++// continue; |
| 31 | ++// count++; |
| 32 | ++// continue; |
| 33 | ++// } |
| 34 | ++// p = endofname(expr); |
| 35 | ++// if (p != expr) { |
| 36 | ++// expr = p; |
| 37 | ++// count++; |
| 38 | ++// continue; |
| 39 | ++// } |
| 40 | ++// } |
| 41 | ++// return count; |
| 42 | ++//} |
| 43 | ++ |
| 44 | + static arith_t |
| 45 | + evaluate_string(arith_state_t *math_state, const char *expr) |
| 46 | + { |
| 47 | +@@ -584,10 +606,12 @@ evaluate_string(arith_state_t *math_state, const char *expr) |
| 48 | + const char *errmsg; |
| 49 | + const char *start_expr = expr = skip_whitespace(expr); |
| 50 | + unsigned expr_len = strlen(expr) + 2; |
| 51 | +- /* Stack of integers */ |
| 52 | +- /* The proof that there can be no more than strlen(startbuf)/2+1 |
| 53 | +- * integers in any given correct or incorrect expression |
| 54 | +- * is left as an exercise to the reader. */ |
| 55 | ++ /* Stack of integers/names */ |
| 56 | ++ /* There can be no more than strlen(startbuf)/2+1 |
| 57 | ++ * integers/names in any given correct or incorrect expression. |
| 58 | ++ * (modulo "09v09v09v09v09v" case, |
| 59 | ++ * but we have code to detect that early) |
| 60 | ++ */ |
| 61 | + var_or_num_t *const numstack = alloca((expr_len / 2) * sizeof(numstack[0])); |
| 62 | + var_or_num_t *numstackptr = numstack; |
| 63 | + /* Stack of operator tokens */ |
| 64 | +@@ -652,6 +676,13 @@ evaluate_string(arith_state_t *math_state, const char *expr) |
| 65 | + numstackptr->var = NULL; |
| 66 | + errno = 0; |
| 67 | + numstackptr->val = strto_arith_t(expr, (char**) &expr); |
| 68 | ++ /* A number can't be followed by another number, or a variable name. |
| 69 | ++ * We'd catch this later anyway, but this would require numstack[] |
| 70 | ++ * to be twice as deep to handle strings where _every_ char is |
| 71 | ++ * a new number or name. Example: 09v09v09v09v09v09v09v09v09v |
| 72 | ++ */ |
| 73 | ++ if (isalnum(*expr) || *expr == '_') |
| 74 | ++ goto err; |
| 75 | + //bb_error_msg("val:%lld", numstackptr->val); |
| 76 | + if (errno) |
| 77 | + numstackptr->val = 0; /* bash compat */ |
0 commit comments