Apple-2gs-SW/hush
1
0
Fork 0
mirror of https://github.com/sheumann/hush.git synced 2025-01-26 14:33:00 +00:00
Code Issues Projects Releases Wiki Activity

ash: in heredoc code, fix access past the end of allocated memory. Closes 9276

Browse Source 
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
This commit is contained in:
Denys Vlasenko 2016-09-25 21:24:04 +02:00
parent 13f20919b2
commit 557482c1cb
1 changed files with 19 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
shell/ash.c
View File

@ -5112,8 +5112,26 @@ openredirect(union node *redir)
char *fname; char *fname;
int f; int f;
fname = redir->nfile.expfname;
switch (redir->nfile.type) { switch (redir->nfile.type) {
/* Can't happen, our single caller does this itself */
// case NTOFD:
// case NFROMFD:
// return -1;
case NHERE:
case NXHERE:
return openhere(redir);
}
/* For N[X]HERE, reading redir->nfile.expfname would touch beyond
* allocated space. Do it only when we know it is safe.
*/
fname = redir->nfile.expfname;
switch (redir->nfile.type) {
default:
#if DEBUG
abort();
#endif
case NFROM: case NFROM:
f = open(fname, O_RDONLY); f = open(fname, O_RDONLY);
if (f < 0) if (f < 0)
@ -5146,20 +5164,6 @@ openredirect(union node *redir)
if (f < 0) if (f < 0)
goto ecreate; goto ecreate;
break; break;
default:
#if DEBUG
abort();
#endif
/* Fall through to eliminate warning. */
/* Our single caller does this itself */
// case NTOFD:
// case NFROMFD:
// f = -1;
// break;
case NHERE:
case NXHERE:
f = openhere(redir);
break;
} }
return f; return f;