Re: [patch] segfault in sh for bogus redirection

From: Stefan Farfeleder <stefanf_at_FreeBSD.org>
Date: Tue, 15 Jul 2008 22:28:52 +0200
On Mon, Jul 14, 2008 at 01:06:35AM +0200, Simon L. Nielsen wrote:
> Hey Stefan (and other people familiar with the sh(1) code),
> 
> I stumbled on a corner case bug in sh(1) where it segfaults instead of
> giving a proper error message.  This only happens when you do
> something stupid, but I thought it should be fixed anyway.
> 
> When you redirect to an unset or empty variable things fail:
> 
>      $ sh -c 'echo 1 >&$a'
>      Segmentation fault (core dumped)
> 
> With patch:
> 
>      $ sh -c 'echo 1 >&$a'
>      Syntax error: Bad fd number
> 
> I have made a patch which fixes the issue (attached) so it fails
> normally with an error, but I'm not sure if it's the right way of
> fixing it.  Do you think this fix is OK, or is there a better way to
> do this?
> 
> I also included a regression test to check for the problem.

Hi,

I don't think your patch is correct.  The value of 'fn.list->text' is
not properly initialised in eval.c:441 and only NULL by chance.  Try
this patch instead.  I still need to test it properly though.

Received on Tue Jul 15 2008 - 18:46:05 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:39:32 UTC