diff mbox series

[4/6] eval: Avoid crash when redirecting to file descriptor in expredir

Message ID 20180907083414.14673-5-andrew.shadura@collabora.co.uk (mailing list archive)
State Superseded
Delegated to: Herbert Xu
Headers show
Series [1/6] exec: Don't execute binary files if execve() returned ENOEXEC. | expand

Commit Message

Andrej Shadura Sept. 7, 2018, 8:34 a.m. UTC 
From: Bernhard Übelacker <bernhardu@mailbox.org>

When trying to redirect output to a filedescriptor contained in an
environment variable, but if that variable is empty, dash crashes
with a segmentation fault. To reproduce, run the following:

    echo test >&$EMPTY_VARIABLE

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>
Bug-Debian: https://bugs.debian.org/861354
---
 src/eval.c | 3 +++
 1 file changed, 3 insertions(+)
diff mbox series

Patch

diff --git a/src/eval.c b/src/eval.c
index 6185db4..ee43fa9 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -516,6 +516,7 @@  expredir(union node *n)
 
 	for (redir = n ; redir ; redir = redir->nfile.next) {
 		struct arglist fn;
+		fn.list = NULL;
 		fn.lastp = &fn.list;
 		switch (redir->type) {
 		case NFROMTO:
@@ -530,6 +531,8 @@  expredir(union node *n)
 		case NTOFD:
 			if (redir->ndup.vname) {
 				expandarg(redir->ndup.vname, &fn, EXP_FULL | EXP_TILDE);
+				if (!fn.list)
+					sh_error("ambiguous redirect");
 				fixredir(redir, fn.list->text, 1);
 			}
 			break;