From: Peter Stephenson <p.stephenson@samsung.com>
To: Branden Archer <brarcher@lexmark.com>, zsh-workers@zsh.org
Subject: Re: NULL pointer dereference in zsh 5.3.1 with builtin chdir
Date: Tue, 13 Jun 2017 15:20:07 +0100 [thread overview]
Message-ID: <20170613152007.4c87c24b@pwslap01u.europe.root.pri> (raw)
In-Reply-To: <CAADoZg3-UZb4Tfj6SbTAuDLmrYBKhAuecUUGw7jBkWipiHDFaw@mail.gmail.com>
On Tue, 13 Jun 2017 09:26:32 -0400
Branden Archer <brarcher@lexmark.com> wrote:
> A NULL pointer dereference has been discovered in zsh 5.3.1 when built for
> x86. The details are as follows:
>
> - A script starts with #!/bin/sh , but /bin/sh is a symlink to /bin/zsh
> - The script is executed with execve() by invoking "/bin/sh -c script", and
> no environment variables are added. This results in only the following
> environment variables being present inside of the script:
>
> LOGNAME=root
> SHLVL=1
> PWD=/usr/share
> OLDPWD=/home/root
> _=/usr/bin/env
>
> - The script cd's into another directory then invokes 'cd' by itself to
> change directories to the home directory.
> - If the top of the script is #!/bin/zsh the issue does not happen
Thanks, it was very easy to reproduce, after I guessed what "feature"
this was related to --- we've had trouble with HOME not being set
in sh compatibility mode before. You need to be in zsh for the ARGV0
trick to work:
(unset HOME; ARGV0=sh zsh -c cd)
> - The issue also does not happen on bash
Presumably this isn't really relevant? I have a hard time imagining
why null dereferences in one shell should be connected with those in
another. There's no code in common, but maybe that wasn't obvious.
The following includes a specific fix for HOME not being set and a
catch-all lower down if dir isn't set for some other reason (paranoia).
diff --git a/Src/builtin.c b/Src/builtin.c
index 0b39494..4144e80 100644
--- a/Src/builtin.c
+++ b/Src/builtin.c
@@ -880,8 +880,11 @@ cd_get_dest(char *nam, char **argv, int hard, int func)
dir = nextnode(firstnode(dirstack));
if (dir)
zinsertlinknode(dirstack, dir, getlinknode(dirstack));
- else if (func != BIN_POPD)
+ else if (func != BIN_POPD) {
+ if (!home)
+ zwarnnam(nam, "HOME not set");
zpushnode(dirstack, ztrdup(home));
+ }
} else if (!argv[1]) {
int dd;
char *end;
@@ -936,6 +939,10 @@ cd_get_dest(char *nam, char **argv, int hard, int func)
if (!dir) {
dir = firstnode(dirstack);
}
+ if (!dir || !getdata(dir)) {
+ DPUTS(1, "Directory not set, not detected early enough");
+ return NULL;
+ }
if (!(dest = cd_do_chdir(nam, getdata(dir), hard))) {
if (!target)
zsfree(getlinknode(dirstack));
diff --git a/Test/B01cd.ztst b/Test/B01cd.ztst
index 94447e7..8d4f095 100644
--- a/Test/B01cd.ztst
+++ b/Test/B01cd.ztst
@@ -137,6 +137,10 @@ F:something is broken. But you already knew that.
0:
?(eval):cd:3: not a directory: link_to_nonexistent
+ (unset HOME; ARGV0=sh $ZTST_testdir/../Src/zsh -c cd)
+1:Implicit cd with unset HOME.
+?zsh:cd:1: HOME not set
+
%clean
# This optional section cleans up after the test, if necessary,
# e.g. killing processes etc. This is in addition to the removal of *.tmp
next prev parent reply other threads:[~2017-06-13 14:20 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CGME20170613132811epcas1p416411899b1aacc5eb8ae319ca0ff711f@epcas1p4.samsung.com>
2017-06-13 13:26 ` Branden Archer
2017-06-13 14:20 ` Peter Stephenson [this message]
2017-06-13 14:23 ` Peter Stephenson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170613152007.4c87c24b@pwslap01u.europe.root.pri \
--to=p.stephenson@samsung.com \
--cc=brarcher@lexmark.com \
--cc=zsh-workers@zsh.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/zsh/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).