mirror of
https://git.busybox.net/busybox.git
synced 2024-12-15 16:33:22 +08:00
A fix from Larry Doolittle for some nasty segfaults when sh.c tried to free a
corrupted cmd pointer, and where it would truncate a command line at the first double space. -Erik
This commit is contained in:
parent
5ec5415402
commit
4987bbf979
6
lash.c
6
lash.c
@ -970,10 +970,10 @@ static int expand_arguments(char *command)
|
||||
{
|
||||
|
||||
int flags = GLOB_NOCHECK|GLOB_BRACE|GLOB_TILDE;
|
||||
char * tmpcmd;
|
||||
char * tmpcmd, *cmd, *cmd_copy;
|
||||
/* We need a clean copy, so strsep can mess up the copy while
|
||||
* we write stuff into the original (in a minute) */
|
||||
char * cmd = strdup(command);
|
||||
cmd = cmd_copy = strdup(command);
|
||||
*command = '\0';
|
||||
for (tmpcmd = cmd; (tmpcmd = strsep(&cmd, " \t")) != NULL;) {
|
||||
if (*tmpcmd == '\0')
|
||||
@ -1006,7 +1006,7 @@ static int expand_arguments(char *command)
|
||||
globfree (&expand_result);
|
||||
}
|
||||
}
|
||||
free(cmd);
|
||||
free(cmd_copy);
|
||||
trim(command);
|
||||
}
|
||||
|
||||
|
6
sh.c
6
sh.c
@ -970,10 +970,10 @@ static int expand_arguments(char *command)
|
||||
{
|
||||
|
||||
int flags = GLOB_NOCHECK|GLOB_BRACE|GLOB_TILDE;
|
||||
char * tmpcmd;
|
||||
char * tmpcmd, *cmd, *cmd_copy;
|
||||
/* We need a clean copy, so strsep can mess up the copy while
|
||||
* we write stuff into the original (in a minute) */
|
||||
char * cmd = strdup(command);
|
||||
cmd = cmd_copy = strdup(command);
|
||||
*command = '\0';
|
||||
for (tmpcmd = cmd; (tmpcmd = strsep(&cmd, " \t")) != NULL;) {
|
||||
if (*tmpcmd == '\0')
|
||||
@ -1006,7 +1006,7 @@ static int expand_arguments(char *command)
|
||||
globfree (&expand_result);
|
||||
}
|
||||
}
|
||||
free(cmd);
|
||||
free(cmd_copy);
|
||||
trim(command);
|
||||
}
|
||||
|
||||
|
@ -970,10 +970,10 @@ static int expand_arguments(char *command)
|
||||
{
|
||||
|
||||
int flags = GLOB_NOCHECK|GLOB_BRACE|GLOB_TILDE;
|
||||
char * tmpcmd;
|
||||
char * tmpcmd, *cmd, *cmd_copy;
|
||||
/* We need a clean copy, so strsep can mess up the copy while
|
||||
* we write stuff into the original (in a minute) */
|
||||
char * cmd = strdup(command);
|
||||
cmd = cmd_copy = strdup(command);
|
||||
*command = '\0';
|
||||
for (tmpcmd = cmd; (tmpcmd = strsep(&cmd, " \t")) != NULL;) {
|
||||
if (*tmpcmd == '\0')
|
||||
@ -1006,7 +1006,7 @@ static int expand_arguments(char *command)
|
||||
globfree (&expand_result);
|
||||
}
|
||||
}
|
||||
free(cmd);
|
||||
free(cmd_copy);
|
||||
trim(command);
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user