sh: Fix crash due to uninitialized here-document.

If an ; or & token was followed by an EOF token, pending here-documents were
left uninitialized. Execution would crash, either in the main shell process
for literal here-documents or in a child process for expanded
here-documents. In the latter case the problem is hard to detect apart from
the core dumps and log messages.

Side effect: slightly different retries on inputs where EOF is not
persistent.

Note that tools/regression/bin/sh/parser/heredoc6.0 still causes a similar
crash in a child process. The text passed to eval is malformed and should be
rejected.

1 files changed, 3 insertions, 0 deletions

diff --git a/bin/sh/parser.c b/bin/sh/parser.c
index 9c89d9f..69d3e6f 100644
--- a/bin/sh/parser.c
+++ b/bin/sh/parser.c
@@ -269,6 +269,9 @@ list(int nlflag)
 				parseheredoc();
 				if (nlflag)
 					return n1;
+			} else if (tok == TEOF && nlflag) {
+				parseheredoc();
+				return n1;
 			} else {
 				tokpushback++;
 			}