dc: crash on colon : operator

[istvan bak <bdhpfl@gmail.com>]

Hello.

dc crashes because a Blk* sometimes ends up both in the freelist and
on the stack, and in the symbol table. It tries to free what had
already been freed.

To make it crash (each line is a separate input to dc):

1 sa 2 :a le d sa v :a
1 sa 2 :a le d sa :a
1 sa 2 :a le d sa c

This is one input:
- 1 :
1 2 3 - 1 :

@@ -707,15 +710,15 @@
 				p = sptr->val;
 				if(length(p)-PTRSZ < c*PTRSZ) {
 					q = copy(p,(c+PTRSZ)*PTRSZ);
 					release(p);
 					p = q;
 				}
 			}
+			sptr->val = p;
 			seekc(p,c*PTRSZ);
 			q = lookwd(p);
 			if(q!=0)
 				release(q);
 			s = pop();
 			EMPTY;
 			salterwd(p, s);
-			sptr->val = p;


set sptr->val to a consistent value before EMTPY causes a jump. After
the if/else block, either sptr->val == p (old p, which is on the hfree
freelist), or sptr->val == 0. Both are bad.

Two unrelated stuff: dcgetwd() can return 0. all other uses check for
0 ptr; so should the below case. and there's a buffer overflow. I
haven't tried to crash these.

Full patch:

diff -r cbc842a5093b sys/src/cmd/dc.c
--- a/sys/src/cmd/dc.c	Sun Nov 08 14:21:14 2020 -0800
+++ b/sys/src/cmd/dc.c	Tue Nov 10 19:22:07 2020 +0100
@@ -638,8 +638,11 @@
 				p = sptr->val;
 				if(c >= ARRAYST) {
 					rewind(p);
-					while(sfeof(p) == 0)
-						release(dcgetwd(p));
+					while(sfeof(p) == 0) {
+						q = dcgetwd(p);
+						if(q != 0)
+							release(q);
+					}
 				}
 				release(p);
 			} else {
@@ -711,6 +714,7 @@
 					p = q;
 				}
 			}
+			sptr->val = p;
 			seekc(p,c*PTRSZ);
 			q = lookwd(p);
 			if(q!=0)
@@ -718,7 +722,6 @@
 			s = pop();
 			EMPTY;
 			salterwd(p, s);
-			sptr->val = p;
 			continue;
 		case ';':
 			p = pop();
@@ -1921,7 +1924,8 @@
 		sl = line;
 		*sl++ = c;
 		while((c = readc()) != '\n')
-			*sl++ = c;
+			if(sl < line+100-1)
+				*sl++ = c;
 		*sl = 0;
 		if((pid = fork()) == 0) {
 			execl("/bin/rc","rc","-c",line,nil);