Re: Out-of-bounds read in parse_comsub()

[Chet Ramey]

On 10/27/17 11:32 AM, Eduardo A. Bustamante López wrote:
> On Thu, Oct 26, 2017 at 11:07:57PM +0200, Jakub Wilk wrote:
> [...]
>> Bash Version: 20171020 snapshot
>>
>> Apparently an out-of-bounds read can happen in parse_comsub() when checking
>> script sytnax. To reproduce, rebuild bash with AddressSanitizer enabled and
>> run:
>>
>>   $ printf 
>> '$(00\177%012d\1%d00\177%090d\177%028d(%0267d\177%010d<<-\276%019d\n\n' | 
>> bash -n
> 
> I can reproduce this error too. It seems `ret' is missing a NUL terminator, so
> `STREQN' reads past the allocated buffer.

Thanks for the report and the pointer to the right place to fix.  Here's
the fix I went with.

Chet

-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, UTech, CWRU    c...@case.edu    http://cnswww.cns.cwru.edu/~chet/

*** ../bash-20171020/parse.y    2017-10-01 20:25:17.000000000 -0400
--- parse.y     2017-10-27 15:08:29.000000000 -0400
***************
*** 3839,3843 ****
              while ((tflags & LEX_STRIPDOC) && ret[tind] == '\t')
                tind++;
!             if (STREQN (ret + tind, heredelim, hdlen))
                {
                  tflags &= ~(LEX_STRIPDOC|LEX_INHEREDOC|LEX_QUOTEDDOC);
--- 3839,3843 ----
              while ((tflags & LEX_STRIPDOC) && ret[tind] == '\t')
                tind++;
!             if (retind-tind == hdlen && STREQN (ret + tind, heredelim, hdlen))
                {
                  tflags &= ~(LEX_STRIPDOC|LEX_INHEREDOC|LEX_QUOTEDDOC);