From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 16372 invoked by alias); 10 Feb 2015 11:33:10 -0000 Mailing-List: contact zsh-workers-help@zsh.org; run by ezmlm Precedence: bulk X-No-Archive: yes List-Id: Zsh Workers List List-Post: List-Help: X-Seq: 34496 Received: (qmail 26709 invoked from network); 10 Feb 2015 11:32:56 -0000 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on f.primenet.com.au X-Spam-Level: X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,RCVD_IN_DNSWL_LOW autolearn=ham version=3.3.2 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=hiOQRtfwFq8lr9E00VGo7vKTOHxWPutnUcrjEYVVYMI=; b=auqrZJvF7JlMzKzivJXqBDgJ9qSQU3yjvRi0Zk6raYBB92bBhok6/+zm/Vw8+B1WKV ElZaqmNqtQ2QwLNPmvezxzOTLnhKmB48W6s8MzdxEU8etq/KHMoLr1rgVGF615TtAco8 WxA3aOElZQrfy11M//CE+2fO+CUeeBdZCszUIPOLrBqVsarPKy8xn+sqv1PIA2RZllhW epPVAiFeW7FqFIst6rUJ+Q2ORQYbbrY/rRg0WBjmcXjJFqQohNu4kFR8dq/ScwPaG5Sc oNnOi4A0RLwGj4Q4CIhedLWfSXM887ryJUTY2gSFy3m4Qst7daJmoxGdvfV3EkuoaWsR SSwA== MIME-Version: 1.0 X-Received: by 10.42.249.2 with SMTP id mi2mr29729609icb.36.1423567973008; Tue, 10 Feb 2015 03:32:53 -0800 (PST) In-Reply-To: <20150210111811.1c851f7f@pwslap01u.europe.root.pri> References: <1423552346-18827-1-git-send-email-mikachu@gmail.com> <20150210093729.476bab46@pwslap01u.europe.root.pri> <20150210111811.1c851f7f@pwslap01u.europe.root.pri> Date: Tue, 10 Feb 2015 12:32:52 +0100 Message-ID: Subject: Re: PATCH: Fix use-after-free for print -zf and print -sf From: Mikael Magnusson To: Peter Stephenson Cc: zsh workers Content-Type: text/plain; charset=UTF-8 On Tue, Feb 10, 2015 at 12:18 PM, Peter Stephenson wrote: > On Tue, 10 Feb 2015 12:13:12 +0100 > Mikael Magnusson wrote: >> Oops, actually I think I do need it, since I want fout being NULL to >> short circuit the whole if statement to false, and currently it's >> interpreted as if ((fout && (fout != stdout)) ? .. : ..), resulting in >> a call to fflush(NULL) which flushes all open output buffers. I should >> probably have quoted both lines of the if. :) > > Yes, I missed that... that's kind of why I talked about rewriting it... > > pws - /* Testing EBADF special-cases >&- redirections */ - if (fout && ((fout != stdout) ? (fclose(fout) != 0) : - (fflush(fout) != 0 && errno != EBADF))) { - zwarnnam(name, "write error: %e", errno); - ret = 1; - } +#ifdef HAVE_OPEN_MEMSTREAM + if (fout) +#endif + /* Testing EBADF special-cases >&- redirections */ + if ((fout != stdout) ? (fclose(fout) != 0) : + (fflush(fout) != 0 && errno != EBADF)) { + zwarnnam(name, "write error: %e", errno); + ret = 1; + } return ret; } This would make it very clear that fout can only be NULL in one very particular case, and also leaves the main EBADF thing the same as the other places in the function... (sorry for bikeshedding so much over this). Which of these do you prefer? -- Mikael Magnusson