emo/busybox
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

awk: Guard pointer chasing when parsing ternary expressions.

Browse Source 
Avoids an uninit pointer deref for some malformed ternary exprs.

Add a test that would crash in busybox before this fix.

Signed-off-by: Brian Foley <bpfoley@google.com>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
This commit is contained in:
Brian Foley 2019-01-01 13:40:58 -08:00 committed by Denys Vlasenko
parent 11cb9eeffe
commit dac15a10ac
2 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
editors/awk.c
View File

@ -1265,7 +1265,7 @@ static node *parse_expr(uint32_t iexp)
debug_printf_parse("%s(%x)\n", __func__, iexp); debug_printf_parse("%s(%x)\n", __func__, iexp);
sn.info = PRIMASK; sn.info = PRIMASK;
sn.r.n = glptr = NULL; sn.r.n = sn.a.n = glptr = NULL;
xtc = TC_OPERAND | TC_UOPPRE | TC_REGEXP | iexp; xtc = TC_OPERAND | TC_UOPPRE | TC_REGEXP | iexp;
while (!((tc = next_token(xtc)) & iexp)) { while (!((tc = next_token(xtc)) & iexp)) {
@ -1287,6 +1287,7 @@ static node *parse_expr(uint32_t iexp)
|| ((t_info == vn->info) && ((t_info & OPCLSMASK) == OC_COLON)) || ((t_info == vn->info) && ((t_info & OPCLSMASK) == OC_COLON))
) { ) {
vn = vn->a.n; vn = vn->a.n;
if (!vn->a.n) syntax_error(EMSG_UNEXP_TOKEN);
} }
if ((t_info & OPCLSMASK) == OC_TERNARY) if ((t_info & OPCLSMASK) == OC_TERNARY)
t_info += P(6); t_info += P(6);

3
testsuite/awk.tests
View File

@ -338,6 +338,9 @@ testing "awk continue" \
testing "awk handles invalid for loop" \ testing "awk handles invalid for loop" \
"awk '{ for() }' 2>&1" "awk: cmd. line:1: Unexpected token\n" "" "" "awk '{ for() }' 2>&1" "awk: cmd. line:1: Unexpected token\n" "" ""
testing "awk handles colon not preceded by ternary" \
"awk 'foo:bar:' 2>&1" "awk: cmd. line:1: Unexpected token\n" "" ""
# testing "description" "command" "result" "infile" "stdin" # testing "description" "command" "result" "infile" "stdin"
testing 'awk negative field access' \ testing 'awk negative field access' \
'awk 2>&1 -- '\''{ $(-1) }'\' \ 'awk 2>&1 -- '\''{ $(-1) }'\' \