From: Peter Stephenson <p.stephenson@samsung.com>
To: zsh-workers@zsh.org
Cc: Eduardo Bustamante <dualbus@gmail.com>
Subject: Re: Another Zsh parser segmentation fault (heredoc)
Date: Mon, 08 May 2017 17:45:26 +0100 [thread overview]
Message-ID: <20170508174526.1058d8eb@pwslap01u.europe.root.pri> (raw)
In-Reply-To: <CAOSMAuueStTR2dS_YptP55cmdtLzP7NU_OmSeWw6=ie3pqU=tA@mail.gmail.com>
On Mon, 8 May 2017 08:49:49 -0500
Eduardo Bustamante <dualbus@gmail.com> wrote:
> dualbus@debian:~/src/zsh/zsh$ git rev-parse HEAD
> f25d01a97c61fdac5d6e0a6a8fb63b5b2b5f3393
>
> dualbus@debian:~/bash-fuzzing/zsh-parser$ cat -v getredirs
> 0 {^X}<<0
That's an ASCII character 24 but any single non-identifier character
triggers the underlying bug.
There's an off-by-one in the test for the argument, or, to use the
technical phrase, crap programming.
This isn't a syntax error as the {varid} syntax was added quite late, so
it errs on the side of leaving irrelevant arguments alone.
pws
diff --git a/Src/parse.c b/Src/parse.c
index b0de9a8..8769baa 100644
--- a/Src/parse.c
+++ b/Src/parse.c
@@ -1836,7 +1836,7 @@ par_simple(int *cmplx, int nr)
if (*ptr == Outbrace && ptr > tokstr + 1)
{
- if (itype_end(tokstr+1, IIDENT, 0) >= ptr - 1)
+ if (itype_end(tokstr+1, IIDENT, 0) >= ptr)
{
char *toksave = tokstr;
char *idstring = dupstrpfx(tokstr+1, eptr-tokstr-1);
diff --git a/Test/A04redirect.ztst b/Test/A04redirect.ztst
index 2671080..cb82751 100644
--- a/Test/A04redirect.ztst
+++ b/Test/A04redirect.ztst
@@ -165,6 +165,15 @@
?About to close a second time
*?\(eval\):*: failed to close file descriptor *
+ eval $'fn-varid() { print {\x18}<<0 }'
+ { which -x2 fn-varid; fn-varid } | tr $'\x18' '?'
+0:Regression test for off-by-one in varid check
+>fn-varid () {
+> print {?} <<0
+>0
+>}
+>{?}
+
print foo >&-
0:'>&-' redirection
prev parent reply other threads:[~2017-05-08 16:45 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CGME20170508135047epcas1p1387b0bef4ef63d286a47d043880b3ce9@epcas1p1.samsung.com>
2017-05-08 13:49 ` Eduardo Bustamante
2017-05-08 16:45 ` Peter Stephenson [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170508174526.1058d8eb@pwslap01u.europe.root.pri \
--to=p.stephenson@samsung.com \
--cc=dualbus@gmail.com \
--cc=zsh-workers@zsh.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/zsh/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).