search for: expandmeta

...;a=commit;h=7154953196c34e244e0e32e73b82ec6a6c29c4e5 Author: Herbert Xu <herbert at gondor.apana.org.au> AuthorDate: Sun, 25 Mar 2018 16:38:00 +0800 Committer: Ben Hutchings <ben at decadent.org.uk> CommitDate: Fri, 25 Jan 2019 02:57:21 +0000 [klibc] expand: Fix buffer overflow in expandmeta The native version of expandmeta allocates a buffer that may be overrun for two reasons. First of all the size is 1 byte too small but this is normally hidden because the minimum size is rounded up to 2048 bytes. Secondly, if the directory level is deep enough, any buffer can be overrun. This p...

...mit;h=e09252abe2baa4f033807c0c77ce273a804f041a Author: Herbert Xu <herbert at gondor.apana.org.au> AuthorDate: Sun, 25 Mar 2018 16:38:00 +0800 Committer: Ben Hutchings <ben at decadent.org.uk> CommitDate: Sat, 28 Mar 2020 21:42:54 +0000 [klibc] dash: expand: Fix buffer overflow in expandmeta [ dash commit 0f3806dd899ace97d5909f195882697ef9dd1eaa ] The native version of expandmeta allocates a buffer that may be overrun for two reasons. First of all the size is 1 byte too small but this is normally hidden because the minimum size is rounded up to 2048 bytes. Secondly, if the director...

...u> Signed-off-by: Ben Hutchings <ben at decadent.org.uk> --- usr/dash/expand.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/usr/dash/expand.c b/usr/dash/expand.c index f52f34c9..3abfa0c4 100644 --- a/usr/dash/expand.c +++ b/usr/dash/expand.c @@ -1205,7 +1205,8 @@ expandmeta(str, flag) ckfree(p); switch (i) { case 0: - if (!(pglob.gl_flags & GLOB_MAGCHAR)) + if ((pglob.gl_flags & (GLOB_NOMAGIC | GLOB_NOCHECK)) == + (GLOB_NOMAGIC | GLOB_NOCHECK)) goto nometa2; addglob(&pglob); globfree(&pglob);

...u> Signed-off-by: Ben Hutchings <ben at decadent.org.uk> --- usr/dash/expand.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/usr/dash/expand.c b/usr/dash/expand.c index f52f34c9..3abfa0c4 100644 --- a/usr/dash/expand.c +++ b/usr/dash/expand.c @@ -1205,7 +1205,8 @@ expandmeta(str, flag) ckfree(p); switch (i) { case 0: - if (!(pglob.gl_flags & GLOB_MAGCHAR)) + if ((pglob.gl_flags & (GLOB_NOMAGIC | GLOB_NOCHECK)) == + (GLOB_NOMAGIC | GLOB_NOCHECK)) goto nometa2; addglob(&pglob); globfree(&pglob);

...ar *, int, int, int, int, int); STATIC char *evalvar(char *, int); STATIC size_t strtodest(const char *, const char *, int); STATIC void memtodest(const char *, size_t, const char *, int); -STATIC ssize_t varvalue(char *, int, int); +STATIC ssize_t varvalue(char *, int, int, int *); STATIC void expandmeta(struct strlist *, int); #ifdef HAVE_GLOB STATIC void addglob(const glob_t *); @@ -722,6 +722,7 @@ evalvar(char *p, int flag) ssize_t varlen; int easy; int quoted; + int nulonly; varflags = *p++; subtype = varflags & VSTYPE; @@ -732,11 +733,12 @@ evalvar(char *p, int flag) quoted...

...ar *, int, int, int, int, int); STATIC char *evalvar(char *, int); STATIC size_t strtodest(const char *, const char *, int); STATIC void memtodest(const char *, size_t, const char *, int); -STATIC ssize_t varvalue(char *, int, int); +STATIC ssize_t varvalue(char *, int, int, int *); STATIC void expandmeta(struct strlist *, int); #ifdef HAVE_GLOB STATIC void addglob(const glob_t *); @@ -722,6 +722,7 @@ evalvar(char *p, int flag) ssize_t varlen; int easy; int quoted; + int nulonly; varflags = *p++; subtype = varflags & VSTYPE; @@ -732,11 +733,12 @@ evalvar(char *p, int flag) quoted...

...ckq(union node *, int); STATIC char *evalvar(char *, int); static size_t strtodest(const char *p, int flags); -static void memtodest(const char *p, size_t len, int flags); +static size_t memtodest(const char *p, size_t len, int flags); STATIC ssize_t varvalue(char *, int, int, int); STATIC void expandmeta(struct strlist *, int); #ifdef HAVE_GLOB @@ -133,7 +133,7 @@ STATIC int pmatch(const char *, const char *); #else #define pmatch(a, b) !fnmatch((a), (b), 0) #endif -STATIC int cvtnum(intmax_t); +static size_t cvtnum(intmax_t num, int flags); STATIC size_t esclen(const char *, const char *); S...

...-STATIC size_t strtodest(const char *, const char *, int); -STATIC void memtodest(const char *, size_t, const char *, int); +static size_t strtodest(const char *p, int flags); +static void memtodest(const char *p, size_t len, int flags); STATIC ssize_t varvalue(char *, int, int, int); STATIC void expandmeta(struct strlist *, int); #ifdef HAVE_GLOB @@ -359,7 +357,6 @@ exptilde(char *startp, char *p, int flag) signed char c; char *name; const char *home; - int quotes = flag & QUOTES_ESC; name = p + 1; @@ -388,7 +385,7 @@ done: if (!home) goto lose; *p = c; - strtodest(home, SQSYN...

...int, int, int, int, int); STATIC char *evalvar(char *, int); STATIC size_t strtodest(const char *, const char *, int); STATIC void memtodest(const char *, size_t, const char *, int); -STATIC ssize_t varvalue(char *, int, int, int *); +STATIC ssize_t varvalue(char *, int, int, int); STATIC void expandmeta(struct strlist *, int); #ifdef HAVE_GLOB STATIC void addglob(const glob_t *); @@ -712,7 +712,6 @@ evalvar(char *p, int flag) int c; int startloc; ssize_t varlen; - int easy; int quoted; varflags = *p++; @@ -723,12 +722,11 @@ evalvar(char *p, int flag) quoted = flag & EXP_QUOTE...

...int, int, int, int, int); STATIC char *evalvar(char *, int); STATIC size_t strtodest(const char *, const char *, int); STATIC void memtodest(const char *, size_t, const char *, int); -STATIC ssize_t varvalue(char *, int, int, int *); +STATIC ssize_t varvalue(char *, int, int, int); STATIC void expandmeta(struct strlist *, int); #ifdef HAVE_GLOB STATIC void addglob(const glob_t *); @@ -712,7 +712,6 @@ evalvar(char *p, int flag) int c; int startloc; ssize_t varlen; - int easy; int quoted; varflags = *p++; @@ -723,12 +722,11 @@ evalvar(char *p, int flag) quoted = flag & EXP_QUOTE...

...ommands. We have to deal with @@ -203,7 +204,7 @@ expandarg(union node *arg, struct arglist *arglist, int flag) * TODO - EXP_REDIR */ if (flag & EXP_FULL) { - ifsbreakup(p, &exparg); + ifsbreakup(p, -1, &exparg); *exparg.lastp = NULL; exparg.lastp = &exparg.list; expandmeta(exparg.list, flag); @@ -1016,15 +1017,18 @@ recordregion(int start, int end, int nulonly) * Break the argument string into pieces based upon IFS and add the * strings to the argument list. The regions of the string to be * searched for IFS characters have been stored by recordregion. + * If...

...ommands. We have to deal with @@ -203,7 +204,7 @@ expandarg(union node *arg, struct arglist *arglist, int flag) * TODO - EXP_REDIR */ if (flag & EXP_FULL) { - ifsbreakup(p, &exparg); + ifsbreakup(p, -1, &exparg); *exparg.lastp = NULL; exparg.lastp = &exparg.list; expandmeta(exparg.list, flag); @@ -1016,15 +1017,18 @@ recordregion(int start, int end, int nulonly) * Break the argument string into pieces based upon IFS and add the * strings to the argument list. The regions of the string to be * searched for IFS characters have been stored by recordregion. + * If...