external/cde
1
0
Fork 0
mirror of git://git.code.sf.net/p/cdesktopenv/code synced 2025-03-09 15:50:02 +00:00
Code Issues Releases Wiki Activity

parse.c: fix use-after-free probs related to funstaks()

Browse source 
When the funstaks() function deletes a stack, other code could
still reference that stack's pointer, at least if a script's DEBUG
trap changed the function context by assigning to ${.sh.level}.
This crashed @ormaaj's funcname.ksh script in certain contexts, at
least when run as a dot script or in a virtual subshell.

This allows that script to run in all contexts by making
funstaks(s) set the stack pointer to NULL after deleting the stack
and making various other points in the code check for a null
pointer before dereferencing it.

This may not be the most elegant fix but (in my testing) it does
work, even when compiling ksh with AddressSanitiser.

Thanks to @JohnoKing for help researching this problem.

Resolves: https://github.com/ksh93/ksh/issues/212
This commit is contained in:
Martijn Dekker 2022-06-14 13:18:48 +01:00
parent 4b22fd5d0f
commit 69d37d5eae
4 changed files with 125 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

15
src/cmd/ksh93/sh/parse.c
View file

@ -527,10 +527,16 @@ void sh_funstaks(register struct slnod *slp,int flag)
if(slp->slchild)
sh_funstaks(slp->slchild,flag);
slp = slp->slnext;
if(flag<=0)
stakdelete(slpold->slptr);
else
staklink(slpold->slptr);
if(slpold->slptr)
{
if(flag<=0)
{
stakdelete(slpold->slptr);
slpold->slptr = NIL(Stak_t*);
}
else
staklink(slpold->slptr);
}
}
}
/*
@ -953,6 +959,7 @@ static Shnode_t *funct(Lex_t *lexp)
{
sh.st.staklist = slp->slnext;
stakdelete(slp->slptr);
slp->slptr = NIL(Stak_t*);
}
siglongjmp(*sh.jmplist,jmpval);
}