Fix a segfault in lash, hush, and cmdedit. Each of these used

xgetcwd, but did not check the return for a NULL, and then continued
to call strlen on the NULL when the cwd had been removed from under it.
 -Erik

diff --git a/Makefile b/Makefile
index 7ab060f7c7c98fc420315ce5e738d7ead50c7fca..cbaf057049d480ee0838c459acc380a9b505f4a7 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -259,7 +259,7 @@ endif
 LIBBB_MSRC=libbb/messages.c
 LIBBB_MESSAGES= full_version name_too_long omitting_directory not_a_directory \
 memory_exhausted invalid_date invalid_option io_error dash_dash_help \
-write_error too_few_args name_longer_than_foo
+write_error too_few_args name_longer_than_foo unknown
 LIBBB_MOBJ=$(patsubst %,$(LIBBB)/%.o, $(LIBBB_MESSAGES))
 
 

diff --git a/cmdedit.c b/cmdedit.c
index ce5450032eff30ccdf69d367134d65e013031fb0..ec9939312a6ce57df86fd0cbe33496c53f5d15d3 100644 (file)
--- a/cmdedit.c
+++ b/cmdedit.c
@@ -355,6 +355,10 @@ static void parse_prompt(const char *prmt_ptr)
        char  c;
        char *pbuf;
 
+       if (!pwd_buf) {
+               pwd_buf=unknown;
+       }
+
        while (*prmt_ptr) {
                pbuf    = buf;
                pbuf[1] = 0;

diff --git a/hush.c b/hush.c
index abc8f6e60ad0cdd916eda86e41eb084479000cd0..9a2243a8927ae0b43dead7ac64e4dd7673e57773 100644 (file)
--- a/hush.c
+++ b/hush.c
@@ -429,6 +429,8 @@ static int builtin_cd(struct child_prog *child)
                return EXIT_FAILURE;
        }
        cwd = xgetcwd(cwd);
+       if (!cwd)
+               cwd = unknown;
        return EXIT_SUCCESS;
 }
 
@@ -568,6 +570,8 @@ static int builtin_jobs(struct child_prog *child)
 static int builtin_pwd(struct child_prog *dummy)
 {
        cwd = xgetcwd(cwd);
+       if (!cwd)
+               cwd = unknown;
        puts(cwd);
        return EXIT_SUCCESS;
 }
@@ -2307,6 +2311,8 @@ int shell_main(int argc, char **argv)
        
        /* initialize the cwd -- this is never freed...*/
        cwd = xgetcwd(0);
+       if (!cwd)
+               cwd = unknown;
 #ifdef BB_FEATURE_COMMAND_EDITING
        cmdedit_set_initial_prompt();
 #else

diff --git a/include/libbb.h b/include/libbb.h
index 21af5688ad1a4960c6db8289b55a8047a8611bed..fde58b0a6a3e26f3574c478b88288a6c36875f56 100644 (file)
--- a/include/libbb.h
+++ b/include/libbb.h
@@ -282,5 +282,6 @@ extern const char * const dash_dash_help;
 extern const char * const write_error;
 extern const char * const too_few_args;
 extern const char * const name_longer_than_foo;
+extern const char * const unknown;
 
 #endif /* __LIBBB_H__ */

diff --git a/lash.c b/lash.c
index 1d128355cafd1cfd63e250d106ffec683ad22057..0129d6c02d441515df960f1e93ee8805cc9c4328 100644 (file)
--- a/lash.c
+++ b/lash.c
@@ -297,7 +297,8 @@ static int builtin_cd(struct child_prog *child)
                return EXIT_FAILURE;
        }
        cwd = xgetcwd(cwd);
-
+       if (!cwd)
+               cwd = unknown;
        return EXIT_SUCCESS;
 }
 
@@ -412,6 +413,9 @@ static int builtin_jobs(struct child_prog *child)
 /* built-in 'pwd' handler */
 static int builtin_pwd(struct child_prog *dummy)
 {
+       cwd = xgetcwd(cwd);
+       if (!cwd)
+               cwd = unknown;
        printf( "%s\n", cwd);
        return EXIT_SUCCESS;
 }
@@ -1827,7 +1831,6 @@ void free_memory(void)
 {
        if (cwd) {
                free(cwd);
-               cwd = NULL;
        }
        if (local_pending_command)
                free(local_pending_command);
@@ -1919,6 +1922,8 @@ int shell_main(int argc_l, char **argv_l)
 
        /* initialize the cwd -- this is never freed...*/
        cwd = xgetcwd(0);
+       if (!cwd)
+               cwd = unknown;
 
 #ifdef BB_FEATURE_CLEAN_UP
        atexit(free_memory);

diff --git a/libbb/libbb.h b/libbb/libbb.h
index 21af5688ad1a4960c6db8289b55a8047a8611bed..fde58b0a6a3e26f3574c478b88288a6c36875f56 100644 (file)
--- a/libbb/libbb.h
+++ b/libbb/libbb.h
@@ -282,5 +282,6 @@ extern const char * const dash_dash_help;
 extern const char * const write_error;
 extern const char * const too_few_args;
 extern const char * const name_longer_than_foo;
+extern const char * const unknown;
 
 #endif /* __LIBBB_H__ */

diff --git a/libbb/messages.c b/libbb/messages.c
index 99c2bc9d52d9d25d29f9c531d847d5f04f20ace1..910cb8fa24ccbbb922707b2fd320f8b1d06e4b20 100644 (file)
--- a/libbb/messages.c
+++ b/libbb/messages.c
@@ -58,4 +58,7 @@
 #ifdef L_name_longer_than_foo
        const char * const name_longer_than_foo = "Names longer than %d chars not supported.";
 #endif
+#ifdef L_unknown
+       const char * const unknown = "(unknown)";
+#endif
 

diff --git a/shell/cmdedit.c b/shell/cmdedit.c
index ce5450032eff30ccdf69d367134d65e013031fb0..ec9939312a6ce57df86fd0cbe33496c53f5d15d3 100644 (file)
--- a/shell/cmdedit.c
+++ b/shell/cmdedit.c
@@ -355,6 +355,10 @@ static void parse_prompt(const char *prmt_ptr)
        char  c;
        char *pbuf;
 
+       if (!pwd_buf) {
+               pwd_buf=unknown;
+       }
+
        while (*prmt_ptr) {
                pbuf    = buf;
                pbuf[1] = 0;

diff --git a/shell/hush.c b/shell/hush.c
index abc8f6e60ad0cdd916eda86e41eb084479000cd0..9a2243a8927ae0b43dead7ac64e4dd7673e57773 100644 (file)
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -429,6 +429,8 @@ static int builtin_cd(struct child_prog *child)
                return EXIT_FAILURE;
        }
        cwd = xgetcwd(cwd);
+       if (!cwd)
+               cwd = unknown;
        return EXIT_SUCCESS;
 }
 
@@ -568,6 +570,8 @@ static int builtin_jobs(struct child_prog *child)
 static int builtin_pwd(struct child_prog *dummy)
 {
        cwd = xgetcwd(cwd);
+       if (!cwd)
+               cwd = unknown;
        puts(cwd);
        return EXIT_SUCCESS;
 }
@@ -2307,6 +2311,8 @@ int shell_main(int argc, char **argv)
        
        /* initialize the cwd -- this is never freed...*/
        cwd = xgetcwd(0);
+       if (!cwd)
+               cwd = unknown;
 #ifdef BB_FEATURE_COMMAND_EDITING
        cmdedit_set_initial_prompt();
 #else

diff --git a/shell/lash.c b/shell/lash.c
index 1d128355cafd1cfd63e250d106ffec683ad22057..0129d6c02d441515df960f1e93ee8805cc9c4328 100644 (file)
--- a/shell/lash.c
+++ b/shell/lash.c
@@ -297,7 +297,8 @@ static int builtin_cd(struct child_prog *child)
                return EXIT_FAILURE;
        }
        cwd = xgetcwd(cwd);
-
+       if (!cwd)
+               cwd = unknown;
        return EXIT_SUCCESS;
 }
 
@@ -412,6 +413,9 @@ static int builtin_jobs(struct child_prog *child)
 /* built-in 'pwd' handler */
 static int builtin_pwd(struct child_prog *dummy)
 {
+       cwd = xgetcwd(cwd);
+       if (!cwd)
+               cwd = unknown;
        printf( "%s\n", cwd);
        return EXIT_SUCCESS;
 }
@@ -1827,7 +1831,6 @@ void free_memory(void)
 {
        if (cwd) {
                free(cwd);
-               cwd = NULL;
        }
        if (local_pending_command)
                free(local_pending_command);
@@ -1919,6 +1922,8 @@ int shell_main(int argc_l, char **argv_l)
 
        /* initialize the cwd -- this is never freed...*/
        cwd = xgetcwd(0);
+       if (!cwd)
+               cwd = unknown;
 
 #ifdef BB_FEATURE_CLEAN_UP
        atexit(free_memory);