dc: Parse error & fix out of bounds read in xc_program_printString

function                                             old     new   delta
xc_program_print                                     712     735     +23

Signed-off-by: Brian Foley <bpfoley@google.com>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

diff --git a/miscutils/bc.c b/miscutils/bc.c
index 016300ac19ed895848ae592183c68912fcd395ac..e492f0f504e3215c7c850555ec450ba32b0237d4 100644 (file)
--- a/miscutils/bc.c
+++ b/miscutils/bc.c
@@ -5456,11 +5456,13 @@ static void xc_program_printString(const char *str)
                        char *n;
 
                        c = *str++;
-                       n = strchr(esc, c); // note: c can be NUL
-                       if (!n) {
+                       n = strchr(esc, c); // note: if c is NUL, n = \0 at end of esc
+                       if (!n || !c) {
                                // Just print the backslash and following character
                                bb_putchar('\\');
                                ++G.prog.nchars;
+                               // But if we're at the end of the string, stop
+                               if (!c) break;
                        } else {
                                if (n - esc == 0) // "\n" ?
                                        G.prog.nchars = SIZE_MAX;

diff --git a/testsuite/dc.tests b/testsuite/dc.tests
index 1fc13c2018db1211bb772da1fde96007a118b7cc..361bc84599cd57c32078103d0163c56288d36e36 100755 (executable)
--- a/testsuite/dc.tests
+++ b/testsuite/dc.tests
@@ -59,6 +59,26 @@ testing "dc: x should work with strings created from a" \
        "42\n" \
        "" ""
 
+testing "dc: p should print invalid escapes" \
+       "dc -e '[\q] p'" \
+       "\\q\n" \
+       "" ""
+
+testing "dc: p should print trailing backslashes" \
+       "dc -e '[q\] p'" \
+       "q\\\\\n" \
+       "" ""
+
+testing "dc: p should parse/print single backslashes" \
+       "dc -e '[\] p'" \
+       "\\\\\n" \
+       "" ""
+
+testing "dc: p should print single backslash strings" \
+       "dc -e '92 a p'" \
+       "\\\\\n" \
+       "" ""
+
 testing "dc read" \
        "dc -finput" \
        "2\n9\n1\n" \