github-repos/make
1
0
Fork 0
mirror of https://github.com/mirror/make.git synced 2025-01-13 13:50:05 +08:00
Code Issues Packages Projects Releases Wiki Activity

[SV 65172] Avoid buffer overruns when expanding for $(shell ...)

Browse Source 
Reported-by: MIAOW Miao <guoyr_2013@hotmail.com>
Patch from: Henrik Carlqvist <hc981@poolhem.se>
Test from: Dmitry Goncharov <dgoncharov@users.sf.net>

* src/expand.c (recursively_expand_for_file): Check the variable name
before checking for equality so we don't overrun the buffer.
* tests/scripts/functions/shell: Add a test with a very long variable.
This commit is contained in:
Paul Smith 2024-01-18 17:54:59 -05:00
parent 31036e648f
commit 25049fef16
2 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/expand.c
View File

@ -163,7 +163,7 @@ recursively_expand_for_file (struct variable *v, struct file *file)
/* We could create a hash for the original environment for speed, but a
reasonably written makefile shouldn't hit this situation... */
for (ep = environ; *ep != 0; ++ep)
if ((*ep)[nl] == '=' && strncmp (*ep, v->name, nl) == 0)
if (strncmp (*ep, v->name, nl) == 0 && (*ep)[nl] == '=')
return xstrdup ((*ep) + nl + 1);
/* If there's nothing in the parent environment, use the empty string.

11
tests/scripts/functions/shell
View File

@ -213,4 +213,15 @@ endif
'--no-print-directory -j2', ": 2\n: 1");
}
if ($port_type eq 'UNIX') {
# sv 65172.
# Buffer overrun in recursively_expand_for_file on a variable with a long
# name.
my $v = "a1234567890" x 4 x 1000;
run_make_test("
export $v=\$(shell echo hello)
all:; \@echo \$\$$v
", '', "hello\n");
}
1;