[PATCH 4/6] eval: Avoid crash when redirecting to file descriptor in expredir

[Andrej Shadura <andrew.shadura@xxxxxxxxxxxxxxx>]

From: Bernhard Übelacker <bernhardu@xxxxxxxxxxx>

When trying to redirect output to a filedescriptor contained in an
environment variable, but if that variable is empty, dash crashes
with a segmentation fault. To reproduce, run the following:

    echo test >&$EMPTY_VARIABLE

Signed-off-by: Andrej Shadura <andrew.shadura@xxxxxxxxxxxxxxx>
Bug-Debian: https://bugs.debian.org/861354
---
 src/eval.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/eval.c b/src/eval.c
index 6185db4..ee43fa9 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -516,6 +516,7 @@ expredir(union node *n)
 
 	for (redir = n ; redir ; redir = redir->nfile.next) {
 		struct arglist fn;
+		fn.list = NULL;
 		fn.lastp = &fn.list;
 		switch (redir->type) {
 		case NFROMTO:
@@ -530,6 +531,8 @@ expredir(union node *n)
 		case NTOFD:
 			if (redir->ndup.vname) {
 				expandarg(redir->ndup.vname, &fn, EXP_FULL | EXP_TILDE);
+				if (!fn.list)
+					sh_error("ambiguous redirect");
 				fixredir(redir, fn.list->text, 1);
 			}
 			break;
-- 
2.17.1