From: Denys Vlasenko <vda.linux@googlemail.com>
Date: Fri, 30 Sep 2016 09:35:54 +0000 (+0200)
Subject: ash: Avoid overflow for very long variable name
X-Git-Tag: 1_26_0~219
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=50e6d42c1967cbd3b07441876af2a7ff2bbbf63f;p=oweals%2Fbusybox.git

ash: Avoid overflow for very long variable name

Upstream commit:

    Date: Tue, 3 Jul 2012 17:32:33 +0800
    Avoid overflow for very long variable name

    Otherwise, this:
      $ perl -le 'print "v"x(2**31+1) ."=1"' | dash
    provokes integer overflow

    Signed-off-by: Jim Meyering <meyering@redhat.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
---

diff --git a/shell/ash.c b/shell/ash.c
index 59905aa7b..a1b211ae0 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -11274,7 +11274,7 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
 	/* NB: syntax parameter fits into smallint */
 	/* c parameter is an unsigned char or PEOF or PEOA */
 	char *out;
-	int len;
+	size_t len;
 	char line[EOFMARKLEN + 1];
 	struct nodelist *bqlist;
 	smallint quotef;