external/cde
1
0
Fork 0
mirror of git://git.code.sf.net/p/cdesktopenv/code synced 2025-03-09 15:50:02 +00:00
Code Issues Releases Wiki Activity

Fix crash due to double free() when sourcing multiple files

Browse source 
There is a bug in sh_eval() that may cause ksh to crash due to a
double free() after sourcing multiple files with '.' or 'source'
if a longjmp is triggered, e.g. by a syntax error.

This applies a fix from Siteshwar Vashist:
https://www.mail-archive.com/ast-developers@lists.research.att.com/msg01943.html

src/cmd/ksh93/sh/xec.c: sh_eval():
- Zero file descriptor io_save after closing it. This prevents a
  double free() after returning from a longjmp.

src/cmd/ksh93/tests/basic.sh:
- Add reproducer as regression test.
This commit is contained in:
Martijn Dekker 2020-07-09 15:09:52 +01:00
parent ae92cd897e
commit a8f6d6b842
4 changed files with 38 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/cmd/ksh93/sh/xec.c
View file

@ -624,7 +624,11 @@ int sh_eval(register Sfio_t *iop, int mode)
if(lineno)
shp->inlineno = lineno;
if(io_save)
{
sfclose(io_save);
io_save = 0;
}
sh_freeup(shp);
shp->st.staklist = saveslp;
shp->fn_reset = 0;