From: Eric Andersen <andersen@codepoet.org>
Date: Mon, 12 Mar 2001 21:36:49 +0000 (-0000)
Subject: A fix from Larry Doolittle for some nasty segfaults when sh.c tried to free a
X-Git-Tag: 0_50~61
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=4987bbf97924044c88007c45ee2674d97b93ad92;p=oweals%2Fbusybox.git

A fix from Larry Doolittle for some nasty segfaults when sh.c tried to free a
corrupted cmd pointer, and where it would truncate a command line at the first
double space.
 -Erik
---

diff --git a/lash.c b/lash.c
index d321c929b..67d6e4f51 100644
--- a/lash.c
+++ b/lash.c
@@ -970,10 +970,10 @@ static int expand_arguments(char *command)
 	{
         
 		int flags = GLOB_NOCHECK|GLOB_BRACE|GLOB_TILDE;
-		char * tmpcmd;
+		char * tmpcmd, *cmd, *cmd_copy;
 		/* We need a clean copy, so strsep can mess up the copy while
 		 * we write stuff into the original (in a minute) */
-		char * cmd = strdup(command);
+		cmd = cmd_copy = strdup(command);
 		*command = '\0';
 		for (tmpcmd = cmd; (tmpcmd = strsep(&cmd, " \t")) != NULL;) {
 			if (*tmpcmd == '\0')
@@ -1006,7 +1006,7 @@ static int expand_arguments(char *command)
 				globfree (&expand_result);
 			}
 		}
-		free(cmd);
+		free(cmd_copy);
 		trim(command);
 	}
 	
diff --git a/sh.c b/sh.c
index d321c929b..67d6e4f51 100644
--- a/sh.c
+++ b/sh.c
@@ -970,10 +970,10 @@ static int expand_arguments(char *command)
 	{
         
 		int flags = GLOB_NOCHECK|GLOB_BRACE|GLOB_TILDE;
-		char * tmpcmd;
+		char * tmpcmd, *cmd, *cmd_copy;
 		/* We need a clean copy, so strsep can mess up the copy while
 		 * we write stuff into the original (in a minute) */
-		char * cmd = strdup(command);
+		cmd = cmd_copy = strdup(command);
 		*command = '\0';
 		for (tmpcmd = cmd; (tmpcmd = strsep(&cmd, " \t")) != NULL;) {
 			if (*tmpcmd == '\0')
@@ -1006,7 +1006,7 @@ static int expand_arguments(char *command)
 				globfree (&expand_result);
 			}
 		}
-		free(cmd);
+		free(cmd_copy);
 		trim(command);
 	}
 	
diff --git a/shell/lash.c b/shell/lash.c
index d321c929b..67d6e4f51 100644
--- a/shell/lash.c
+++ b/shell/lash.c
@@ -970,10 +970,10 @@ static int expand_arguments(char *command)
 	{
         
 		int flags = GLOB_NOCHECK|GLOB_BRACE|GLOB_TILDE;
-		char * tmpcmd;
+		char * tmpcmd, *cmd, *cmd_copy;
 		/* We need a clean copy, so strsep can mess up the copy while
 		 * we write stuff into the original (in a minute) */
-		char * cmd = strdup(command);
+		cmd = cmd_copy = strdup(command);
 		*command = '\0';
 		for (tmpcmd = cmd; (tmpcmd = strsep(&cmd, " \t")) != NULL;) {
 			if (*tmpcmd == '\0')
@@ -1006,7 +1006,7 @@ static int expand_arguments(char *command)
 				globfree (&expand_result);
 			}
 		}
-		free(cmd);
+		free(cmd_copy);
 		trim(command);
 	}