1
0
Fork 0
mirror of git://git.code.sf.net/p/cdesktopenv/code synced 2025-03-09 15:50:02 +00:00

combining alarm and IFS caused segfault (rhbz#1176670)

The undocumented alarm builtin executes actions unsafely so that
'read' with an IFS assignment crashed when an alarm was triggered.

This applies an edited version of a Red Hat patch:
642af4d6/f/ksh-20120801-alarmifs.patch

Prior discussion:
https://bugzilla.redhat.com/1176670

src/cmd/ksh93/bltins/alarm.c:
- Add a TODO note based on dgk's 2014 email cited in the RH bug.
- When executing the trap function, save and restore the IFS table.

src/cmd/ksh93/sh/init.c: get_ifs():
- Remove now-unnecessary SHOPT_MULTIBYTE preprocessor directives as
  8477d2ce lets the compiler optimise out multibyte code if needed.
- Initialise the 0 position of the IFS table to S_EOF. This
  corresponds with the static state tables in data/lexstates.c.

src/cmd/ksh93/tests/builtins.sh:
- Crash test.
This commit is contained in:
Martijn Dekker 2020-09-27 02:00:55 +02:00
parent f7c3565f4e
commit 18b3f4aa28
3 changed files with 41 additions and 8 deletions

View file

@ -1055,5 +1055,27 @@ do case $bltin in
"(expected string containing $(printf %q "$expect"), got $(printf %q "$actual"))"
done 3< <(builtin)
# ======
# The 'alarm' builtin could make 'read' crash due to IFS table corruption caused by unsafe asynchronous execution.
# https://bugzilla.redhat.com/1176670
if (builtin alarm) 2>/dev/null
then got=$( { "$SHELL" -c '
builtin alarm
alarm -r alarm_handler +.001
i=0
function alarm_handler.alarm
{
let "(++i) > 100" && exit
}
while :; do
echo cargo,odds and ends,jetsam,junk,wreckage,castoffs,sea-drift
done | while IFS="," read arg1 arg2 arg3 arg4 junk; do
:
done
'; } 2>&1)
((!(e = $?))) || err_exit 'crash with alarm and IFS' \
"(got status $e$( ((e>128)) && print -n / && kill -l "$e"), $(printf %q "$got"))"
fi
# ======
exit $((Errors<125?Errors:125))