mirrors/zsh
1
0
Fork 0
mirror of git://git.code.sf.net/p/zsh/code synced 2025-09-07 11:41:16 +02:00
Code Releases Activity

48389: getkeystring() should not return ptr to local var

Browse source 
Now it returns NULL if called with GETKEY_SINGLE_CHAR and next character
is not found. Caller must check the return value.
This commit is contained in:
Jun-ichi Takimoto 2021-04-06 23:05:03 +09:00
parent ccc7ff90a4
commit 0f62e07c80
3 changed files with 36 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
ChangeLog
View file

@ -1,3 +1,8 @@
2021-04-06 Jun-ichi Takimoto <takimoto-j@kba.biglobe.ne.jp>
* 48389: Src/math.c, Src/utils.c: getkeystring(GETKEY_SINGLE_CHAR)
should not return a pointer to a local variable
2021-04-06 Oliver Kiddle <opk@zsh.org> 2021-04-06 Oliver Kiddle <opk@zsh.org>
* Marc Chantreux: users/26579: Completion/Unix/Command/_surfraw: * Marc Chantreux: users/26579: Completion/Unix/Command/_surfraw:

7
Src/math.c
View file

@ -840,13 +840,18 @@ zzlex(void)
if (*ptr == '#') { if (*ptr == '#') {
if (*++ptr == '\\' || *ptr == '#') { if (*++ptr == '\\' || *ptr == '#') {
int v; int v;
char *optr = ptr;
ptr++; ptr++;
if (!*ptr) { if (!*ptr) {
zerr("bad math expression: character missing after ##"); zerr("bad math expression: character missing after ##");
return EOI; return EOI;
} }
ptr = getkeystring(ptr, NULL, GETKEYS_MATH, &v); if(!(ptr = getkeystring(ptr, NULL, GETKEYS_MATH, &v))) {
zerr("bad math expression: bad character after ##");
ptr = optr;
return EOI;
}
yyval.u.l = v; yyval.u.l = v;
return NUM; return NUM;
} }

33
Src/utils.c
View file

@ -6697,13 +6697,21 @@ ucs4toutf8(char *dest, unsigned int wval)
* *
* The return value is unmetafied unless GETKEY_DOLLAR_QUOTE is * The return value is unmetafied unless GETKEY_DOLLAR_QUOTE is
* in use. * in use.
*
* If GETKEY_SINGLE_CHAR is set in how, a next character in the given
* string is parsed, and the character code for it is returned in misc.
* The return value of the function is a pointer to the byte in the
* given string from where the next parsing should start. If the next
* character can't be found then NULL is returned.
* CAUTION: Currently, GETKEY_SINGLE_CHAR can be used only via
* GETKEYS_MATH. Other use of it may cause trouble.
*/ */
/**/ /**/
mod_export char * mod_export char *
getkeystring(char *s, int *len, int how, int *misc) getkeystring(char *s, int *len, int how, int *misc)
{ {
char *buf, tmp[1]; char *buf = NULL, tmp[1];
char *t, *tdest = NULL, *u = NULL, *sstart = s, *tbuf = NULL; char *t, *tdest = NULL, *u = NULL, *sstart = s, *tbuf = NULL;
char svchar = '\0'; char svchar = '\0';
int meta = 0, control = 0, ignoring = 0; int meta = 0, control = 0, ignoring = 0;
@ -6729,9 +6737,11 @@ getkeystring(char *s, int *len, int how, int *misc)
DPUTS((how & (GETKEY_DOLLAR_QUOTE|GETKEY_SINGLE_CHAR)) == DPUTS((how & (GETKEY_DOLLAR_QUOTE|GETKEY_SINGLE_CHAR)) ==
(GETKEY_DOLLAR_QUOTE|GETKEY_SINGLE_CHAR), (GETKEY_DOLLAR_QUOTE|GETKEY_SINGLE_CHAR),
"BUG: incompatible options in getkeystring"); "BUG: incompatible options in getkeystring");
DPUTS((how & GETKEY_SINGLE_CHAR) && (how != GETKEYS_MATH),
"BUG: unsupported options in getkeystring");
if (how & GETKEY_SINGLE_CHAR) if (how & GETKEY_SINGLE_CHAR)
t = buf = tmp; t = tmp;
else { else {
/* Length including terminating NULL */ /* Length including terminating NULL */
int maxlen = 1; int maxlen = 1;
@ -7165,13 +7175,20 @@ getkeystring(char *s, int *len, int how, int *misc)
*/ */
DPUTS((how & (GETKEY_DOLLAR_QUOTE|GETKEY_UPDATE_OFFSET)) == DPUTS((how & (GETKEY_DOLLAR_QUOTE|GETKEY_UPDATE_OFFSET)) ==
GETKEY_DOLLAR_QUOTE, "BUG: unterminated $' substitution"); GETKEY_DOLLAR_QUOTE, "BUG: unterminated $' substitution");
*t = '\0';
if (how & GETKEY_DOLLAR_QUOTE) if (how & GETKEY_SINGLE_CHAR) {
*tdest = '\0'; /* couldn't find a character */
if (how & GETKEY_SINGLE_CHAR)
*misc = 0; *misc = 0;
else return NULL;
*len = ((how & GETKEY_DOLLAR_QUOTE) ? tdest : t) - buf; }
if (how & GETKEY_DOLLAR_QUOTE) {
*tdest = '\0';
*len = tdest - buf;
}
else {
*t = '\0';
*len = t - buf;
}
return buf; return buf;
} }