From: Bart Schaefer <schaefer@brasslantern.com>
To: zsh-workers@zsh.org
Subject: PATCH: Crash bug on garbage input (previously reported to Debian)
Date: Sat, 14 Feb 2015 10:25:34 -0800 [thread overview]
Message-ID: <150214102534.ZM4368@torch.brasslantern.com> (raw)
Garbage input (nul bytes, etc.) can cause the newly-introduced $(...)
parser to become confused during look-ahead and back up the input too
far before attempting a different parse.
The patch below simply detects the problem and turns it into a parse
error with an appropriate warning. It might be helpful to figure out
how the confusion originates but this prevents the crash.
diff --git a/Src/input.c b/Src/input.c
index 2ecac7b..9520fdd 100644
--- a/Src/input.c
+++ b/Src/input.c
@@ -393,12 +393,14 @@ inungetc(int c)
if (((inbufflags & INP_LINENO) || !strin) && c == '\n')
lineno--;
}
-#ifdef DEBUG
else if (!(inbufflags & INP_CONT)) {
+#ifdef DEBUG
/* Just for debugging */
fprintf(stderr, "Attempt to inungetc() at start of input.\n");
- }
#endif
+ zerr("Garbled input at %c (binary file as commands?)", c);
+ return;
+ }
else {
/*
* The character is being backed up from a previous input stack
diff --git a/Src/lex.c b/Src/lex.c
index 433c27f..91628d4 100644
--- a/Src/lex.c
+++ b/Src/lex.c
@@ -503,13 +503,15 @@ cmd_or_math(int cs_type)
/* else unsuccessful: unget the whole thing */
hungetc(c);
lexstop = 0;
- while (lexbuf.len > oldlen) {
+ while (lexbuf.len > oldlen && !errflag) {
lexbuf.len--;
hungetc(itok(*--lexbuf.ptr) ?
ztokens[*lexbuf.ptr - Pound] : *lexbuf.ptr);
}
+ if (errflag)
+ return 2;
hungetc('(');
- return 0;
+ return errflag ? 2 : 0;
}
next reply other threads:[~2015-02-14 18:25 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-02-14 18:25 Bart Schaefer [this message]
2015-02-14 21:42 ` Peter Stephenson
2015-02-15 19:26 ` Bart Schaefer
2015-02-16 12:57 ` Peter Stephenson
2015-02-16 17:04 ` Peter Stephenson
2015-02-16 19:39 ` Bart Schaefer
2015-02-17 12:57 ` Peter Stephenson
2015-02-17 17:13 ` Bart Schaefer
2015-02-17 9:02 ` Mikael Magnusson
2015-02-17 9:39 ` Peter Stephenson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=150214102534.ZM4368@torch.brasslantern.com \
--to=schaefer@brasslantern.com \
--cc=zsh-workers@zsh.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/zsh/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).