Commit daa66ed6 fixed a number of use-after-free bugs in bash pattern substitution, however one "unguarded" STPUTC remained, which is fixed here.
Signed-off-by: Karsten Sperling <[email protected]> --- shell/ash.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/shell/ash.c b/shell/ash.c index d2c5c5d50..51b627fcc 100644 --- a/shell/ash.c +++ b/shell/ash.c @@ -7370,6 +7370,8 @@ subevalvar(char *start, char *str, int strloc, char *restart_detect = stackblock(); if (quotes && *loc == '\\') { STPUTC(CTLESC, expdest); + if (stackblock() != restart_detect) + goto restart; len++; } STPUTC(*loc, expdest); -- 2.39.0 _______________________________________________ busybox mailing list [email protected] http://lists.busybox.net/mailman/listinfo/busybox
