ash: [PARSER] Catch variable length expansions on non-existant specials

Upstream commit:

    Date: Thu, 30 Oct 2014 11:53:35 +0800
    [PARSER] Catch variable length expansions on non-existant specials

    Currently we only check special variable names that follow directly
    after $ or ${.  So errors such as ${#&} are not caught.  This patch
    fixes that by moving the is_special check to just before we print out
    the special variable name.

    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
function                                             old     new   delta
readtoken1                                          2630    2635      +5

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

diff --git a/shell/ash.c b/shell/ash.c
index 15c7c325a9852436a76e53c3af06b134fa7b8048..1917b552c1c39c47b5eec4559d9572d55d48b1a6 100644 (file)
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -12119,7 +12119,7 @@ parsesub: {
                                STPUTC(c, out);
                                c = pgetc_eatbnl();
                        } while (isdigit(c));
-               } else if (is_special(c)) {
+               } else {
                        /* $[{[#]]<specialchar>[}] */
                        int cc = c;
 
@@ -12137,10 +12137,16 @@ parsesub: {
                                        cc = '#';
                                }
                        }
+
+                       if (!is_special(cc)) {
+                               if (subtype == VSLENGTH)
+                                       subtype = 0;
+                               goto badsub;
+                       }
+
                        USTPUTC(cc, out);
-               } else {
-                       goto badsub;
                }
+
                if (c != '}' && subtype == VSLENGTH) {
                        /* ${#VAR didn't end with } */
                        goto badsub;