ash: fix command -- crash

busybox sh -c 'command --' segfaults because parse_command_args
returns a pointer to a null pointer.

Based on commit 18071c7 from git://git.kernel.org/pub/scm/utils/dash/dash.git
by Gerrit Pape.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

diff --git a/shell/ash.c b/shell/ash.c
index 18c7ff523f12cfc17b39947f72bd3c00d3c6b50b..8f0a5e0be0f46b1fd180df7ac4ed6a055e109afe 100644 (file)
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -8878,14 +8878,15 @@ parse_command_args(char **argv, const char **path)
        for (;;) {
                cp = *++argv;
                if (!cp)
-                       return 0;
+                       return NULL;
                if (*cp++ != '-')
                        break;
                c = *cp++;
                if (!c)
                        break;
                if (c == '-' && !*cp) {
-                       argv++;
+                       if (!*++argv)
+                               return NULL;
                        break;
                }
                do {
@@ -8895,7 +8896,7 @@ parse_command_args(char **argv, const char **path)
                                break;
                        default:
                                /* run 'typecmd' for other options */
-                               return 0;
+                               return NULL;
                        }
                        c = *cp++;
                } while (c);