[PATCH 4/6] eval: Avoid crash when redirecting to file descriptor in expredir

[Andrej Shadura]

From: Bernhard Übelacker <bernha...@mailbox.org>

When trying to redirect output to a filedescriptor contained in an
environment variable, but if that variable is empty, dash crashes
with a segmentation fault. To reproduce, run the following:

    echo test >&$EMPTY_VARIABLE

Signed-off-by: Andrej Shadura <andrew.shad...@collabora.co.uk>
Bug-Debian: https://bugs.debian.org/861354
---
 src/eval.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/eval.c b/src/eval.c
index 6185db4..ee43fa9 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -516,6 +516,7 @@ expredir(union node *n)
 
        for (redir = n ; redir ; redir = redir->nfile.next) {
                struct arglist fn;
+               fn.list = NULL;
                fn.lastp = &fn.list;
                switch (redir->type) {
                case NFROMTO:
@@ -530,6 +531,8 @@ expredir(union node *n)
                case NTOFD:
                        if (redir->ndup.vname) {
                                expandarg(redir->ndup.vname, &fn, EXP_FULL | 
EXP_TILDE);
+                               if (!fn.list)
+                                       sh_error("ambiguous redirect");
                                fixredir(redir, fn.list->text, 1);
                        }
                        break;
-- 
2.17.1