diff options
| author | Chet Ramey <chet.ramey@case.edu> | 2019-11-25 01:50:37 +0100 |
|---|---|---|
| committer | Vasyl Gello <vasek.gello@gmail.com> | 2019-11-26 20:25:33 +0000 |
| commit | a823e4b102c5028940e51dbcadfeb116cb07e7a8 (patch) | |
| tree | 45a0896c07b201dc94e1cbc4c1a655ca9b2ff8b1 | |
| parent | ddb19f4a310205fd5e25bd4c60544612b34c44f4 (diff) | |
| download | android_external_bash-a823e4b102c5028940e51dbcadfeb116cb07e7a8.tar.gz android_external_bash-a823e4b102c5028940e51dbcadfeb116cb07e7a8.tar.bz2 android_external_bash-a823e4b102c5028940e51dbcadfeb116cb07e7a8.zip | |
bash: Popd controlled free
popd controlled free (Segmentation fault) with bash 4.2.27,
4.3.48.
Change-Id: I359aa68adc6eb458e3d3ac92fb32eedcd2d419ce
| -rw-r--r-- | builtins/pushd.c | 7 | ||||
| -rw-r--r-- | builtins/pushd.def | 7 |
2 files changed, 12 insertions, 2 deletions
diff --git a/builtins/pushd.c b/builtins/pushd.c index 0185450..cd57401 100644 --- a/builtins/pushd.c +++ b/builtins/pushd.c @@ -255,7 +255,7 @@ popd_builtin (list) break; } - if (which > directory_list_offset || (directory_list_offset == 0 && which == 0)) + if (which > directory_list_offset || (which < -directory_list_offset) || (directory_list_offset == 0 && which == 0)) { pushd_error (directory_list_offset, which_word ? which_word : ""); return (EXECUTION_FAILURE); @@ -277,6 +277,11 @@ popd_builtin (list) remove that directory from the list and shift the remainder of the list into place. */ i = (direction == '+') ? directory_list_offset - which : which; + if (i < 0 || i > directory_list_offset) + { + pushd_error (directory_list_offset, which_word ? which_word : ""); + return (EXECUTION_FAILURE); + } free (pushd_directory_list[i]); directory_list_offset--; diff --git a/builtins/pushd.def b/builtins/pushd.def index aca74ef..ca525d7 100644 --- a/builtins/pushd.def +++ b/builtins/pushd.def @@ -359,7 +359,7 @@ popd_builtin (list) break; } - if (which > directory_list_offset || (directory_list_offset == 0 && which == 0)) + if (which > directory_list_offset || (which < -directory_list_offset) || (directory_list_offset == 0 && which == 0)) { pushd_error (directory_list_offset, which_word ? which_word : ""); return (EXECUTION_FAILURE); @@ -381,6 +381,11 @@ popd_builtin (list) remove that directory from the list and shift the remainder of the list into place. */ i = (direction == '+') ? directory_list_offset - which : which; + if (i < 0 || i > directory_list_offset) + { + pushd_error (directory_list_offset, which_word ? which_word : ""); + return (EXECUTION_FAILURE); + } free (pushd_directory_list[i]); directory_list_offset--; |