From a823e4b102c5028940e51dbcadfeb116cb07e7a8 Mon Sep 17 00:00:00 2001 From: Chet Ramey Date: Mon, 25 Nov 2019 01:50:37 +0100 Subject: bash: Popd controlled free popd controlled free (Segmentation fault) with bash 4.2.27, 4.3.48. Change-Id: I359aa68adc6eb458e3d3ac92fb32eedcd2d419ce --- builtins/pushd.c | 7 ++++++- builtins/pushd.def | 7 ++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/builtins/pushd.c b/builtins/pushd.c index 0185450..cd57401 100644 --- a/builtins/pushd.c +++ b/builtins/pushd.c @@ -255,7 +255,7 @@ popd_builtin (list) break; } - if (which > directory_list_offset || (directory_list_offset == 0 && which == 0)) + if (which > directory_list_offset || (which < -directory_list_offset) || (directory_list_offset == 0 && which == 0)) { pushd_error (directory_list_offset, which_word ? which_word : ""); return (EXECUTION_FAILURE); @@ -277,6 +277,11 @@ popd_builtin (list) remove that directory from the list and shift the remainder of the list into place. */ i = (direction == '+') ? directory_list_offset - which : which; + if (i < 0 || i > directory_list_offset) + { + pushd_error (directory_list_offset, which_word ? which_word : ""); + return (EXECUTION_FAILURE); + } free (pushd_directory_list[i]); directory_list_offset--; diff --git a/builtins/pushd.def b/builtins/pushd.def index aca74ef..ca525d7 100644 --- a/builtins/pushd.def +++ b/builtins/pushd.def @@ -359,7 +359,7 @@ popd_builtin (list) break; } - if (which > directory_list_offset || (directory_list_offset == 0 && which == 0)) + if (which > directory_list_offset || (which < -directory_list_offset) || (directory_list_offset == 0 && which == 0)) { pushd_error (directory_list_offset, which_word ? which_word : ""); return (EXECUTION_FAILURE); @@ -381,6 +381,11 @@ popd_builtin (list) remove that directory from the list and shift the remainder of the list into place. */ i = (direction == '+') ? directory_list_offset - which : which; + if (i < 0 || i > directory_list_offset) + { + pushd_error (directory_list_offset, which_word ? which_word : ""); + return (EXECUTION_FAILURE); + } free (pushd_directory_list[i]); directory_list_offset--; -- cgit v1.2.3