zsh-workers
 help / color / Atom feed
From: Peter Stephenson <p.w.stephenson@ntlworld.com>
To: zsh-workers@zsh.org
Subject: Re: [BUG] Two vulnerabilities in zsh
Date: Sat, 23 May 2020 17:45:14 +0100
Message-ID: <e6d03c3a68196fdb05a2cf5072dc7666cd4a9e17.camel@ntlworld.com> (raw)
In-Reply-To: <20200523021732.73f77b73@tarpaulin.shahaf.local2>

Change of plan: I've done the fix for the original problem the same way
I did the fix for the follow up.  That's because I can no longer convince
myself that a String token last in the buffer is necessarily the very
start of a $-expansion --- it may be true, I'm just not sure --- and we
might as well be consistent in the two case.

The reason I did it that way to begin with was that way back when we
could only back up one input character.  But that hasn't been true since
I rewrote the input layer (between specific I/O types and history) some
time ago now.

The test cases are fixed --- there aren't any trailing spaces, even if
they show up in the patch.

pws


diff --git a/Src/lex.c b/Src/lex.c
index a541defe6..37fcec3e2 100644
--- a/Src/lex.c
+++ b/Src/lex.c
@@ -541,6 +541,17 @@ cmd_or_math_sub(void)
 {
     int c = hgetc(), ret;
 
+    if (c == '\\') {
+	c = hgetc();
+	if (c != '\n') {
+	    hungetc(c);
+	    hungetc('\\');
+	    lexstop = 0;
+	    return skipcomm() ? CMD_OR_MATH_ERR : CMD_OR_MATH_CMD;
+	}
+	c = hgetc();
+    }
+
     if (c == '(') {
 	int lexpos = (int)(lexbuf.ptr - tokstr);
 	add(Inpar);
@@ -998,6 +1009,16 @@ gettokstr(int c, int sub)
 	    break;
 	case LX2_STRING:
 	    e = hgetc();
+	    if (e == '\\') {
+		e = hgetc();
+		if (e != '\n') {
+		    hungetc(e);
+		    hungetc('\\');
+		    lexstop = 0;
+		    break;
+		}
+		e = hgetc();
+	    }
 	    if (e == '[') {
 		cmdpush(CS_MATHSUBST);
 		add(String);
diff --git a/Test/D04parameter.ztst b/Test/D04parameter.ztst
index 6d2dd0d99..e51c955ee 100644
--- a/Test/D04parameter.ztst
+++ b/Test/D04parameter.ztst
@@ -2662,7 +2662,25 @@ F:behavior, see http://austingroupbugs.net/view.php?id=888
 -f:regression test for workers/45843#1
 ?(eval):1: bad substitution
 
-# Temporarily using the 'D' flag because it generates a "BUG:" message in
-# debug builds only.
  $ZTST_testdir/../Src/zsh -fc $'$\\\n('
-1Df:regression test for workers/45843#2: escaped newline in command substitution start token
+1:regression test for workers/45843#2: escaped newline in command substitution start token
+?zsh:2: parse error near `$('
+
+# `
+
+ eval $'echo $\\\n(printf "%d\\n" $(( 4 + 2 )) )'
+0:Normal command substitution with escaped newline
+>6
+
+ eval $'echo $\\\n(( 14 / 2 ))'
+0:Normal math eval with escaped newline after $
+>7
+
+ eval $'echo $(\\\n( 15 / 3 ))'
+0:Normal math eval with escaped newline after $(
+>5
+
+  function '*' { echo What a star; }
+  eval 'echo $(\*)'
+0:Backslash character other than newline is normal after $(
+>What a star


  reply index

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-19  6:48 Aaron Esau
2020-05-19 17:04 ` Daniel Shahaf
2020-05-19 20:38   ` Peter Stephenson
2020-05-20  0:45     ` Daniel Shahaf
2020-05-22 18:56       ` Peter Stephenson
2020-05-22 21:47         ` Peter Stephenson
2020-05-23  2:17           ` Daniel Shahaf
2020-05-23 16:45             ` Peter Stephenson [this message]
2020-05-20  0:40 ` [BUG] Two vulnerabilities in zsh - #1 :: null dereference in check_colon_subscript in subst.c Daniel Shahaf

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=e6d03c3a68196fdb05a2cf5072dc7666cd4a9e17.camel@ntlworld.com \
    --to=p.w.stephenson@ntlworld.com \
    --cc=zsh-workers@zsh.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

zsh-workers

Archives are clonable: git clone --mirror http://inbox.vuxu.org/zsh-workers

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://inbox.vuxu.org/vuxu.archive.zsh.workers


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git