ahp/busybox
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

hush: fix a bug in FEATURE_SH_STANDALONE=y config. Closes 9186

Browse source 
Run this in a "sh SCRIPT":

sha256sum /dev/null
echo END

sha256sum is a NOEXEC applet. It runs in a forked child. Then child exit()s.
By this time, entire script is read, and buffered in a FILE object
from fopen("SCRIPT"). But fgetc() did not consume entire input.
exit() lseeks back by -9 bytes, from <eof> to 'e' in 'echo'.
(this may be libc-specific).
This change of fd position *is shared with the parent*!

Now parent can read more, and it thinks there is another "echo END".
End result: two "echo END"s are run.

Fix this by _exit()ing instead.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
This commit is contained in:
Denys Vlasenko 2016-08-19 18:23:56 +02:00
parent aedc3fe19f
commit 215b0ca6e4
3 changed files with 25 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
libbb/appletlib.c
View file

@ -877,7 +877,9 @@ void FAST_FUNC run_applet_no_and_exit(int applet_no, char **argv)
}
if (ENABLE_FEATURE_SUID)
check_suid(applet_no);
exit(applet_main[applet_no](argc, argv));
xfunc_error_retval = applet_main[applet_no](argc, argv);
/* Note: applet_main() may also not return (die on a xfunc or such) */
xfunc_die();
}
# endif /* NUM_APPLETS > 0 */