On Nov 13, 2007 2:01 PM, Cristian Ionescu-Idbohrn
<[EMAIL PROTECTED]> wrote:
> On Tue, 13 Nov 2007, Cristian Ionescu-Idbohrn wrote:
> > BusyBox v1.8.1 (2007-11-12 19:47:38 CET) multi-call binary
> >
> > /var/empty/ is a directory.
> >
> > # tr '\0' ' ' < /var/empty/
> > Segmentation fault
>
> Looks like tr does not handle this case:
>
> read(0, 0xd5228, 256) = -1 EISDIR (Is a directory)
> --- SIGSEGV (Segmentation fault) @ 0 (0) ---
> +++ killed by SIGSEGV +++
Yep, but the patch follows inline. The read(2) return value was being
stored in an unsigned variable, avoiding the error detection. I also
added an error message, which wasn't implemented.
Cheers,
Fernando Silveira
--- a/coreutils/tr.c 2007-11-09 23:40:51.000000000 -0200
+++ b/coreutils/tr.c 2007-11-13 14:29:55.000000000 -0200
@@ -173,7 +173,8 @@
int idx = 1;
int i;
smalluint flags = 0;
- size_t read_chars = 0, in_index = 0, out_index = 0, c, coded, last = -1;
+ ssize_t read_chars = 0;
+ size_t in_index = 0, out_index = 0, c, coded, last = -1;
RESERVE_CONFIG_UBUFFER(output, BUFSIZ);
RESERVE_CONFIG_BUFFER(vector, ASCII+1);
RESERVE_CONFIG_BUFFER(invec, ASCII+1);
@@ -225,6 +226,8 @@
if (read_chars <= 0) {
if (write(STDOUT_FILENO, (char
*)output, out_index) != out_index)
bb_perror_msg(bb_msg_write_error);
+ if (read_chars < 0)
+ bb_perror_msg(bb_msg_read_error);
exit(EXIT_SUCCESS);
}
in_index = 0;
_______________________________________________
busybox mailing list
[email protected]
http://busybox.net/cgi-bin/mailman/listinfo/busybox
