In builtins/mapfile.def there's this line:
snprintf (execstr, execlen, "%s %d %s", callback, curindex, qline);
If the callback is empty, bash runs '<space><number><space><line>'
This smells a lot like code injection.
$ echo 'echo hello from $0' > ~/bin/0
$ chmod +x ~/bin/0
$ cp ~/bin/{0,1}
$ echo -e 'x\ny' | mapfile -c1 -C ''
hello from /home/izabera/0
hello from /home/izabera/1
^^^ That's not at all the result I expected.
This is a simple patch:
builtins/mapfile.def | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/builtins/mapfile.def b/builtins/mapfile.def
index 03f0b48..f91e432 100644
--- a/builtins/mapfile.def
+++ b/builtins/mapfile.def
@@ -178,6 +178,11 @@ mapfile (fd, line_count_goal, origin, nskip,
callback_quantum, callback, array_n
builtin_error (_("%s: not an indexed array"), array_name);
return (EXECUTION_FAILURE);
}
+ else if (callback && *callback == 0)
+ {
+ builtin_error (_("%s: empty callback"));
+ return (EXECUTION_FAILURE);
+ }
else if (invisible_p (entry))
VUNSETATTR (entry, att_invisible); /* no longer invisible */
---
xoxo iza
