From: Brian Foley <bpfoley@google.com>
Date: Thu, 5 Sep 2019 08:53:21 +0000 (+0200)
Subject: dc: Parse error & fix out of bounds read in xc_program_printString
X-Git-Tag: 1_31_1~7
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=2f3352682e3e0f62aca80c12e64d4509e48df465;p=oweals%2Fbusybox.git

dc: Parse error & fix out of bounds read in xc_program_printString

function                                             old     new   delta
xc_program_print                                     712     735     +23

Signed-off-by: Brian Foley <bpfoley@google.com>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
---

diff --git a/miscutils/bc.c b/miscutils/bc.c
index 44c70cac3..e880293d9 100644
--- a/miscutils/bc.c
+++ b/miscutils/bc.c
@@ -5456,11 +5456,13 @@ static void xc_program_printString(const char *str)
 			char *n;
 
 			c = *str++;
-			n = strchr(esc, c); // note: c can be NUL
-			if (!n) {
+			n = strchr(esc, c); // note: if c is NUL, n = \0 at end of esc
+			if (!n || !c) {
 				// Just print the backslash and following character
 				bb_putchar('\\');
 				++G.prog.nchars;
+				// But if we're at the end of the string, stop
+				if (!c) break;
 			} else {
 				if (n - esc == 0) // "\n" ?
 					G.prog.nchars = SIZE_MAX;
diff --git a/testsuite/dc.tests b/testsuite/dc.tests
index 1fc13c201..361bc8459 100755
--- a/testsuite/dc.tests
+++ b/testsuite/dc.tests
@@ -59,6 +59,26 @@ testing "dc: x should work with strings created from a" \
 	"42\n" \
 	"" ""
 
+testing "dc: p should print invalid escapes" \
+	"dc -e '[\q] p'" \
+	"\\q\n" \
+	"" ""
+
+testing "dc: p should print trailing backslashes" \
+	"dc -e '[q\] p'" \
+	"q\\\\\n" \
+	"" ""
+
+testing "dc: p should parse/print single backslashes" \
+	"dc -e '[\] p'" \
+	"\\\\\n" \
+	"" ""
+
+testing "dc: p should print single backslash strings" \
+	"dc -e '92 a p'" \
+	"\\\\\n" \
+	"" ""
+
 testing "dc read" \
 	"dc -finput" \
 	"2\n9\n1\n" \