Author: jilles
Date: Sun Aug 23 20:44:53 2015
New Revision: 287081
URL: https://svnweb.freebsd.org/changeset/base/287081

Log:
  sh: Don't create bad parse result when postponing a bad substitution error.
  
  An invalid substitution like ${var@} does not cause a parse error but is
  stored in the intermediate representation, to be written as part of the
  error message. If there is a CTL* byte in the stored part, this confuses
  some code such as the code to skip an unused alternative such as in
  ${var-alternative}.
  
  To keep things simple, do not store CTL* bytes.
  
  Found with afl-fuzz.
  
  MFC after:    1 week

Added:
  head/bin/sh/tests/errors/bad-parm-exp7.0   (contents, props changed)
  head/bin/sh/tests/errors/bad-parm-exp8.0   (contents, props changed)
Modified:
  head/bin/sh/parser.c
  head/bin/sh/tests/errors/Makefile

Modified: head/bin/sh/parser.c
==============================================================================
--- head/bin/sh/parser.c        Sun Aug 23 20:39:19 2015        (r287080)
+++ head/bin/sh/parser.c        Sun Aug 23 20:44:53 2015        (r287081)
@@ -1662,7 +1662,7 @@ varname:
                                pungetc();
                        else if (c == '\n' || c == PEOF)
                                synerror("Unexpected end of line in 
substitution");
-                       else
+                       else if (BASESYNTAX[c] != CCTL)
                                USTPUTC(c, out);
                }
                if (subtype == 0) {
@@ -1678,7 +1678,8 @@ varname:
                                                synerror("Unexpected end of 
line in substitution");
                                        if (flags == VSNUL)
                                                STPUTC(':', out);
-                                       STPUTC(c, out);
+                                       if (BASESYNTAX[c] != CCTL)
+                                               STPUTC(c, out);
                                        subtype = VSERROR;
                                } else
                                        subtype = p - types + VSNORMAL;

Modified: head/bin/sh/tests/errors/Makefile
==============================================================================
--- head/bin/sh/tests/errors/Makefile   Sun Aug 23 20:39:19 2015        
(r287080)
+++ head/bin/sh/tests/errors/Makefile   Sun Aug 23 20:44:53 2015        
(r287081)
@@ -19,6 +19,8 @@ FILES+=               bad-parm-exp3.2 bad-parm-exp3.2
 FILES+=                bad-parm-exp4.2 bad-parm-exp4.2.stderr
 FILES+=                bad-parm-exp5.2 bad-parm-exp5.2.stderr
 FILES+=                bad-parm-exp6.2 bad-parm-exp6.2.stderr
+FILES+=                bad-parm-exp7.0
+FILES+=                bad-parm-exp8.0
 FILES+=                option-error.0
 FILES+=                redirection-error.0
 FILES+=                redirection-error2.2

Added: head/bin/sh/tests/errors/bad-parm-exp7.0
==============================================================================
--- /dev/null   00:00:00 1970   (empty, because file is newly added)
+++ head/bin/sh/tests/errors/bad-parm-exp7.0    Sun Aug 23 20:44:53 2015        
(r287081)
@@ -0,0 +1,4 @@
+# $FreeBSD$
+
+v=1
+eval ": $(printf '${v-${\372}}')"

Added: head/bin/sh/tests/errors/bad-parm-exp8.0
==============================================================================
--- /dev/null   00:00:00 1970   (empty, because file is newly added)
+++ head/bin/sh/tests/errors/bad-parm-exp8.0    Sun Aug 23 20:44:53 2015        
(r287081)
@@ -0,0 +1,4 @@
+# $FreeBSD$
+
+v=1
+eval ": $(printf '${v-${w\372}}')"
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"

Reply via email to