From: Denys Vlasenko <vda.linux@googlemail.com>
Date: Sat, 17 Sep 2016 18:53:47 +0000 (+0200)
Subject: ash: add a FIXME for bug 9246
X-Git-Tag: 1_26_0~265
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=7bc3d39695728c6257a95bc2d75e80d3e2431c8b;p=oweals%2Fbusybox.git

ash: add a FIXME for bug 9246

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
---

diff --git a/shell/ash.c b/shell/ash.c
index 789a81cc3..790367bd8 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -11659,9 +11659,18 @@ parsebackq: {
 	str = NULL;
 	savelen = out - (char *)stackblock();
 	if (savelen > 0) {
+		/*
+		 * FIXME: this can allocate very large block on stack and SEGV.
+		 * Example:
+		 * echo "..<100kbytes>..`true` $(true) `true` ..."
+		 * alocates 100kb for every command subst. With about
+		 * a hundred command substitutions stack overflows.
+		 * With larger prepended string, SEGV happens sooner.
+		 */
 		str = alloca(savelen);
 		memcpy(str, stackblock(), savelen);
 	}
+
 	if (oldstyle) {
 		/* We must read until the closing backquote, giving special
 		 * treatment to some slashes, and then push the string and