RepoMirrors/musl
1
0
Fork 0
mirror of git://git.musl-libc.org/musl synced 2025-04-16 20:16:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

avoid malloc of potentially-large string in wordexp

Browse Source
This commit is contained in:
Rich Felker 2011-04-19 23:37:57 -04:00
parent a6054e3c94
commit f0fc95d439
1 changed files with 28 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
src/misc/wordexp.c
View File

@ -5,6 +5,8 @@
#include <limits.h> #include <limits.h>
#include <stdint.h> #include <stdint.h>
#include <stdlib.h> #include <stdlib.h>
#include <sys/wait.h>
#include <signal.h>
static char *getword(FILE *f) static char *getword(FILE *f)
{ {
@ -14,15 +16,17 @@ static char *getword(FILE *f)
int wordexp(const char *s, wordexp_t *we, int flags) int wordexp(const char *s, wordexp_t *we, int flags)
{ {
size_t i, l, len; size_t i, l;
int sq=0, dq=0; int sq=0, dq=0;
size_t np=0; size_t np=0;
char *cmd, *w, **tmp; char *w, **tmp;
char *redir = (flags & WRDE_SHOWERR) ? "" : "2>/dev/null"; char *redir = (flags & WRDE_SHOWERR) ? "" : "2>/dev/null";
int err = 0, status; int err = 0, status;
FILE *f; FILE *f;
size_t wc = 0; size_t wc = 0;
char **wv = 0; char **wv = 0;
int p[2];
pid_t pid;
if (flags & WRDE_REUSE) wordfree(we); if (flags & WRDE_REUSE) wordfree(we);
@ -79,13 +83,26 @@ int wordexp(const char *s, wordexp_t *we, int flags)
i += we->we_offs; i += we->we_offs;
} }
len = 50 + strlen(s); pipe(p);
cmd = malloc(len); pid = fork();
if (!cmd) return WRDE_NOSPACE; if (!pid) {
snprintf(cmd, len, "printf %%s\\\\0 %s %s", s, redir); dup2(p[1], 1);
f = popen(cmd, "r"); close(p[0]);
free(cmd); close(p[1]);
if (!f) return WRDE_NOSPACE; execl("/bin/sh", "sh", "-c",
"eval \"printf %s\\\\\\\\0 $1 $2\"",
"sh", s, redir, (char *)0);
_exit(1);
}
close(p[1]);
f = fdopen(p[0], "r");
if (!f) {
close(p[0]);
kill(pid, SIGKILL);
waitpid(pid, &status, 0);
return WRDE_NOSPACE;
}
l = wv ? i+1 : 0; l = wv ? i+1 : 0;
@ -101,7 +118,8 @@ int wordexp(const char *s, wordexp_t *we, int flags)
} }
if (!feof(f)) err = WRDE_NOSPACE; if (!feof(f)) err = WRDE_NOSPACE;
status = pclose(f); fclose(f);
waitpid(pid, &status, 0);
if (WEXITSTATUS(status)) { if (WEXITSTATUS(status)) {
if (!(flags & WRDE_APPEND)) { if (!(flags & WRDE_APPEND)) {
free(wv); free(wv);