From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on sa.local.altlinux.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00 autolearn=unavailable autolearn_force=no version=3.4.1 To: =?UTF-8?B?0JTQvNC40YLRgNC40Lkg0JvQtdCy0LjQvQ==?= References: <20201030213543.9C351844021E@gitery.altlinux.org> <20201102221840.GA24969@altlinux.org> From: Alexey Appolonov Message-ID: Date: Tue, 3 Nov 2020 04:32:08 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.4.0 MIME-Version: 1.0 In-Reply-To: <20201102221840.GA24969@altlinux.org> Content-Type: text/plain; charset=koi8-r; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Cc: devel@lists.altlinux.org Subject: Re: [devel] [SCM] packages/bash3: heads/p9 X-BeenThere: devel@lists.altlinux.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: ALT Linux Team development discussions List-Id: ALT Linux Team development discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 03 Nov 2020 01:32:15 -0000 Archived-At: List-Archive: List-Post: 03.11.2020 01:18, Dmitry V. Levin пишет: > On Fri, Oct 30, 2020 at 09:35:43PM +0000, Alexey Appolonov wrote: >> Update of /people/alexey/packages/bash3.git > [...] >> commit 0db3057724a11b6e9f3bdca6a831370443aaa06e >> Author: Alexey Appolonov >> Date: Tue Oct 27 14:36:56 2020 +0300 >> >> Preventing a segmentation fault in '_evalfile' func of 'evalfile.c' >> >> Index 'result' can be -1; The index is checked from the top also >> (just in case). > Prevent a potential segmentation fault ... > >> commit 6c6399d5a7cb51ae53c196f0bfdfd92e43711544 >> Author: Alexey Appolonov >> Date: Tue Oct 27 13:53:08 2020 +0300 >> >> Preventing a segmentation fault in 'make_redirection' func of 'make_cmd.c' >> >> Index 'wlen' is -1 if a length of 'w->word' C-string is 0. > Likewise. > > [...] >> diff --git a/bash/builtins/evalfile.c b/bash/builtins/evalfile.c >> index d05bc7b..9eec1a5 100644 >> --- a/bash/builtins/evalfile.c >> +++ b/bash/builtins/evalfile.c >> @@ -149,7 +149,8 @@ file_error_and_exit: >> >> string = (char *)xmalloc (1 + file_size); >> result = read (fd, string, file_size); >> - string[result] = '\0'; >> + if (result >= 0 && result <= file_size) >> + string[result] = '\0'; >> >> return_val = errno; >> close (fd); > Adding a check for result <= file_size? Really? Do you suppose that > read (fd, string, file_size) is ever capable of returning a value > greater than file_size? I just think that the comfort of having such checks outweighs the negligible computational costs that they bring. >> diff --git a/bash/make_cmd.c b/bash/make_cmd.c >> index c819b27..bb33da2 100644 >> --- a/bash/make_cmd.c >> +++ b/bash/make_cmd.c >> @@ -731,7 +731,12 @@ make_redirection (source, instruction, dest_and_filename) >> case r_duplicating_output_word: /* 1>&$foo */ >> w = dest_and_filename.filename; >> wlen = strlen (w->word) - 1; >> - if (w->word[wlen] == '-') /* Yuck */ >> + if (wlen < 0) >> + { >> + programming_error (_("make_redirection: redirection instruction `%d' for an empty file name"), instruction); >> + abort (); >> + } >> + else if (w->word[wlen] == '-') /* Yuck */ >> { >> w->word[wlen] = '\0'; >> if (all_digits (w->word) && legal_number (w->word, &lfd) && lfd == (int)lfd) > A programming error? Is it ever possible to reach the code added by this hunk? It is if "strlen (w->word)" equals 0. The "programming_error" function is used to handle another unlikely scenario (see just below in the code). >> @@ -743,7 +748,6 @@ make_redirection (source, instruction, dest_and_filename) >> else >> temp->instruction = (instruction == r_duplicating_input_word) ? r_move_input_word : r_move_output_word; >> } >> - >> break; >> >> default: > Do you really need to change spacings in bash3? I find it quite distracting in this particular case. And it didn't match the code style anyway.