Bug#1121548: Info received (Bug#1121548: Acknowledgement (posh: heap buffer overflow in posh-0.14.2 tree.c:422 ( p[20] = '\0' after malloc(20) )))

[Michael]

I apologize for the previous patch... it did not set the buf = NULL in the 
declaration... this patch should be used intead:
--- a/tree.c	2013-05-13 02:16:42.000000000 +0800
+++ b/tree.c	2025-12-02 17:31:53.332119894 +0800
@@ -2,6 +2,7 @@
  * command tree climbing
  */
 
+#include <alloca.h>
 #include "sh.h"
 
 #define INDENT	4
@@ -393,12 +394,12 @@
 static void vfptreef(struct shf *shf, int indent, const char *fmt, va_list va)
 {
 	int c;
+	char *buf = NULL;     /* for integer -> string conversions */
+	const size_t sz = 24; /* safe for integer conversions */	
 
 	while ((c = *fmt++))
 	    if (c == '%') {
-		long n;
-		char *p, *q;
-		int neg;
+		char *p;
 
 		switch ((c = *fmt++)) {
 		  case 'c':
@@ -413,20 +414,21 @@
 			p = va_arg(va, char *);
 			tputS(p, shf);
 			break;
-		  case 'd': case 'u': /* decimal */
-			n = (c == 'd') ? va_arg(va, int)
-				       : va_arg(va, unsigned int);
-			neg = c=='d' && n<0;
-			p = q = malloc(20);
-			snprintf(p, 19, "%ld", (neg) ? -n : n);
-			p[20] = '\0';
-
-			if (neg)
-				*--p = '-';
+		  case 'd':
+			if (buf == NULL)
+				buf = alloca(sz);
+			p = buf;
+			snprintf(p, sz, "%d", va_arg(va, int));
+			while (*p)
+				tputc(*p++, shf);
+			break;
+		  case 'u':
+			if (buf == NULL)
+				buf = alloca(sz);
+			p = buf;
+			snprintf(p, sz, "%u", va_arg(va, unsigned int));
 			while (*p)
 				tputc(*p++, shf);
-
-			free(q);
 			break;
 		  case 'T':	/* format tree */
 			ptree(va_arg(va, struct op *), indent, shf);