xfnw/plan9fox
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

dc: fix crashes with : operator (thanks istvan bak)

Browse source 
dc crashes because a Blk* sometimes ends getting double freed.
To make it crash, any of these lines will do:
(each line is a separate input to dc):

1 sa 2 :a le d sa v :a
1 sa 2 :a le d sa :a
1 sa 2 :a le d sa c

Fix by assigning p to sptr->val before EMTPY causes a jump.

Additionally, dcgetwd() can return 0. all other uses check for
0 ptr; Also fix a buffer overflow.
This commit is contained in:
Ori Bernstein 2020-11-21 17:56:34 -08:00
parent 03f209427b
commit ad9b1234c3
1 changed files with 8 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
sys/src/cmd/dc.c
View file

@ -638,8 +638,11 @@ commnds(void)
p = sptr->val;
if(c >= ARRAYST) {
rewind(p);
while(sfeof(p) == 0)
release(dcgetwd(p));
while(sfeof(p) == 0) {
q = dcgetwd(p);
if(q != 0)
release(q);
}
}
release(p);
} else {
@ -711,6 +714,7 @@ commnds(void)
p = q;
}
}
sptr->val = p;
seekc(p,c*PTRSZ);
q = lookwd(p);
if(q!=0)
@ -718,7 +722,6 @@ commnds(void)
s = pop();
EMPTY;
salterwd(p, s);
sptr->val = p;
continue;
case ';':
p = pop();
@ -1921,7 +1924,8 @@ command(void)
sl = line;
*sl++ = c;
while((c = readc()) != '\n')
*sl++ = c;
if(sl-line < sizeof(line)-1)
*sl++ = c;
*sl = 0;
if((pid = fork()) == 0) {
execl("/bin/rc","rc","-c",line,nil);