Re: [PATCH v2] ash: Fix use-after-free on idx variable

2022-08-02 Thread Denys Vlasenko
Applied, thank you. On Wed, Jun 1, 2022 at 4:18 PM wrote: > > From: Sören Tempel > > Consider the following code from ash.c: > > STPUTC(*idx, expdest); > if (quotes && (unsigned char)*idx == CTLESC) { > > The idx variable points to a value in the stack string (as managed > by STP

[PATCH v2] ash: Fix use-after-free on idx variable

2022-06-01 Thread soeren
From: Sören Tempel Consider the following code from ash.c: STPUTC(*idx, expdest); if (quotes && (unsigned char)*idx == CTLESC) { The idx variable points to a value in the stack string (as managed by STPUTC). STPUTC may resize this stack string via realloc(3). If this happens, th