ash: eval: Use the correct expansion mode for fd redirection

Upstream comment:

    Date: Mon, 19 Nov 2018 18:00:32 +0800
    eval: Use the correct expansion mode for fd redirection

    It has been reported that

            echo test >&$EMPTY_VARIABLE

    causes dash to segfault.  This is a symptom of the bigger problem
    that dash tries to perform pathname expansion as well as field
    splitting on the word after >& and <&.  This is wrong and this
    patch fixes it to use the same expansions as done on a normal
    redirection.

    Reported-by: Andrej Shadura <andrew.shadura@collabora.co.uk>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

diff --git a/shell/ash.c b/shell/ash.c
index 97c7f4ef532700081d35b314c5b8e317fa4a4203..a43b6568055f45d610e21e537781a8c6ff802fe4 100644 (file)
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -9445,11 +9445,10 @@ expredir(union node *n)
                case NFROMFD:
                case NTOFD: /* >& */
                        if (redir->ndup.vname) {
-                               expandarg(redir->ndup.vname, &fn, EXP_FULL | EXP_TILDE);
+                               expandarg(redir->ndup.vname, &fn, EXP_TILDE | EXP_REDIR);
                                if (fn.list == NULL)
                                        ash_msg_and_raise_error("redir error");
 #if BASH_REDIR_OUTPUT
-//FIXME: we used expandarg with different args!
                                if (!isdigit_str9(fn.list->text)) {
                                        /* >&file, not >&fd */
                                        if (redir->nfile.fd != 1) /* 123>&file - BAD */