Re: core dump or infinite loop in brace expansion

[Bart Schaefer <schaefer@xxxxxxxxxxxxxxxx>]

On Tue, Jun 10, 2014 at 9:30 AM, Jun T. <takimoto-j@xxxxxxxxxxxxxxxxx>
wrote:

> The following causes a core dump or infinite loop
> (if BRACECCL is not set):
>
> $ print -r {{..~}
> glob.c:2178: BUG: unmatched brace in xpandbraces()
> glob.c:2371: BUG: illegal brace expansion
> glob.c:2371: BUG: illegal brace expansion
> ....
>
> When bracechardots() is called from hasbraces() (line 1972 of glob.c),
> it returns 1, interpreting {{..~} as a character range from '{' to '~'.
>
> But xpandbraces() (lines 2163-2177) doesn't consider {{..~} as a
> character range, and calls DPUTS("BUG: unmatched brace ...").
>


Seems like the right thing would be to make bracechardots() agree with
xpandbraces().

diff --git a/Src/glob.c b/Src/glob.c
index 15a5f70..100c108 100644
--- a/Src/glob.c
+++ b/Src/glob.c
@@ -2122,6 +2122,8 @@ bracechardots(char *str, convchar_t *c1p, convchar_t
*c2p)
     convchar_t cstart, cend;
     char *pnext = str + 1, *pconv, convstr[2];
     if (itok(*pnext)) {
+       if (*pnext == Inbrace)
+           return 0;
        convstr[0] = ztokens[*pnext - Pound];
        convstr[1] = '\0';
        pconv = convstr;