diff options
author | jilles <jilles@FreeBSD.org> | 2015-08-25 21:55:15 +0000 |
---|---|---|
committer | jilles <jilles@FreeBSD.org> | 2015-08-25 21:55:15 +0000 |
commit | 424480153f3c8a83b9eda291dae7ff5e112baf4c (patch) | |
tree | b2ac90e4331870b125760317c214fd30b95887ef /bin | |
parent | 991c19271a64bddd1f8bb9842dd695986630d505 (diff) | |
download | FreeBSD-src-424480153f3c8a83b9eda291dae7ff5e112baf4c.zip FreeBSD-src-424480153f3c8a83b9eda291dae7ff5e112baf4c.tar.gz |
sh: Fix out of bounds read when there is no ] after a [:class:].
The initial check for a matching ] was incorrect if a ] may be consumed by a
[:class:]. The subsequent loop assumed that there must be a ].
Remove the initial check and make the loop cope with a missing ].
Found with afl-fuzz.
MFC after: 1 week
Diffstat (limited to 'bin')
-rw-r--r-- | bin/sh/expand.c | 19 | ||||
-rw-r--r-- | bin/sh/tests/builtins/Makefile | 1 | ||||
-rw-r--r-- | bin/sh/tests/builtins/case20.0 | 9 |
3 files changed, 17 insertions, 12 deletions
diff --git a/bin/sh/expand.c b/bin/sh/expand.c index 193d651..64db701 100644 --- a/bin/sh/expand.c +++ b/bin/sh/expand.c @@ -1464,21 +1464,11 @@ patmatch(const char *pattern, const char *string, int squoted) bt_q = q; break; case '[': { - const char *endp; + const char *savep, *saveq; int invert, found; wchar_t chr; - endp = p; - if (*endp == '!' || *endp == '^') - endp++; - do { - while (*endp == CTLQUOTEMARK) - endp++; - if (*endp == 0) - goto dft; /* no matching ] */ - if (*endp == CTLESC) - endp++; - } while (*++endp != ']'); + savep = p, saveq = q; invert = 0; if (*p == '!' || *p == '^') { invert++; @@ -1497,6 +1487,11 @@ patmatch(const char *pattern, const char *string, int squoted) chr = (unsigned char)*q++; c = *p++; do { + if (c == '\0') { + p = savep, q = saveq; + c = '['; + goto dft; + } if (c == CTLQUOTEMARK) continue; if (c == '[' && *p == ':') { diff --git a/bin/sh/tests/builtins/Makefile b/bin/sh/tests/builtins/Makefile index f3c1dc7..c1e7b64 100644 --- a/bin/sh/tests/builtins/Makefile +++ b/bin/sh/tests/builtins/Makefile @@ -39,6 +39,7 @@ FILES+= case16.0 FILES+= case17.0 FILES+= case18.0 FILES+= case19.0 +FILES+= case20.0 FILES+= cd1.0 FILES+= cd2.0 FILES+= cd3.0 diff --git a/bin/sh/tests/builtins/case20.0 b/bin/sh/tests/builtins/case20.0 new file mode 100644 index 0000000..03a4eb2 --- /dev/null +++ b/bin/sh/tests/builtins/case20.0 @@ -0,0 +1,9 @@ +# $FreeBSD$ + +# Shells do not agree about what this pattern should match, but it is +# certain that it must not crash and the missing close bracket must not +# be simply ignored. + +case B in +[[:alpha:]) echo bad ;; +esac |