diff options
| author | Chet Ramey <chet.ramey@case.edu> | 2019-11-25 01:50:37 +0100 |
|---|---|---|
| committer | Vasyl Gello <vasek.gello@gmail.com> | 2019-11-26 20:24:31 +0000 |
| commit | 5dab935d200c0ec6d18a5fbf5159dd6a1dc1f473 (patch) | |
| tree | ebf3fda60c3b4f93f0cfda349df8dc52946da241 | |
| parent | e69f0429dd813203640719a13716d3d4a093b87e (diff) | |
| download | android_external_bash-5dab935d200c0ec6d18a5fbf5159dd6a1dc1f473.tar.gz android_external_bash-5dab935d200c0ec6d18a5fbf5159dd6a1dc1f473.tar.bz2 android_external_bash-5dab935d200c0ec6d18a5fbf5159dd6a1dc1f473.zip | |
bash: Popd controlled free
popd controlled free (Segmentation fault) with bash 4.2.27,
4.3.48.
Change-Id: I359aa68adc6eb458e3d3ac92fb32eedcd2d419ce
| -rw-r--r-- | builtins/pushd.c | 7 | ||||
| -rw-r--r-- | builtins/pushd.def | 7 |
2 files changed, 12 insertions, 2 deletions
diff --git a/builtins/pushd.c b/builtins/pushd.c index 0185450..cd57401 100644 --- a/builtins/pushd.c +++ b/builtins/pushd.c @@ -255,7 +255,7 @@ popd_builtin (list) break; } - if (which > directory_list_offset || (directory_list_offset == 0 && which == 0)) + if (which > directory_list_offset || (which < -directory_list_offset) || (directory_list_offset == 0 && which == 0)) { pushd_error (directory_list_offset, which_word ? which_word : ""); return (EXECUTION_FAILURE); @@ -277,6 +277,11 @@ popd_builtin (list) remove that directory from the list and shift the remainder of the list into place. */ i = (direction == '+') ? directory_list_offset - which : which; + if (i < 0 || i > directory_list_offset) + { + pushd_error (directory_list_offset, which_word ? which_word : ""); + return (EXECUTION_FAILURE); + } free (pushd_directory_list[i]); directory_list_offset--; diff --git a/builtins/pushd.def b/builtins/pushd.def index aca74ef..ca525d7 100644 --- a/builtins/pushd.def +++ b/builtins/pushd.def @@ -359,7 +359,7 @@ popd_builtin (list) break; } - if (which > directory_list_offset || (directory_list_offset == 0 && which == 0)) + if (which > directory_list_offset || (which < -directory_list_offset) || (directory_list_offset == 0 && which == 0)) { pushd_error (directory_list_offset, which_word ? which_word : ""); return (EXECUTION_FAILURE); @@ -381,6 +381,11 @@ popd_builtin (list) remove that directory from the list and shift the remainder of the list into place. */ i = (direction == '+') ? directory_list_offset - which : which; + if (i < 0 || i > directory_list_offset) + { + pushd_error (directory_list_offset, which_word ? which_word : ""); + return (EXECUTION_FAILURE); + } free (pushd_directory_list[i]); directory_list_offset--; |