Re: [BUG] Interactive (d)ash exits on assigning to readonly from 'command eval'

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 28/10/16 15:55, Denys Vlasenko wrote:
This will probably be mangled by gmail, but here is the proposed fix:

This looks about the right approach, but it causes problems in subshells, a double free:

$ ./busybox ash -c 'readonly x; echo $(command eval x=2)'
ash: eval: line 1: x: is read only
*** Error in `./busybox': free(): invalid pointer: 0x000055a784c1c300 ***
[...]

That's with busybox checked out from git (commit 9db74e49e5b462089c6eec0182d819c0d4708e57), where your patch is applied, completely unpatched and completely default config.

I omitted the backtrace output, but it's popfile() getting called, after popallfiles() has already been called.

Cheers,
Harald van Dijk
--
To unsubscribe from this list: send the line "unsubscribe dash" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [LARTC]     [Bugtraq]     [Yosemite Forum]     [Photo]

  Powered by Linux