Re: NULL pointer dereference in zsh 5.3.1 with builtin chdir

[Peter Stephenson <p.stephenson@xxxxxxxxxxx>]

On Tue, 13 Jun 2017 09:26:32 -0400
Branden Archer <brarcher@xxxxxxxxxxx> wrote:
> A NULL pointer dereference has been discovered in zsh 5.3.1 when built for
> x86. The details are as follows:
> 
> - A script starts with #!/bin/sh , but /bin/sh is a symlink to /bin/zsh
> - The script is executed with execve() by invoking "/bin/sh -c script", and
> no environment variables are added. This results in only the following
> environment variables being present inside of the script:
> 
> LOGNAME=root
> SHLVL=1
> PWD=/usr/share
> OLDPWD=/home/root
> _=/usr/bin/env
> 
> - The script cd's into another directory then invokes 'cd' by itself to
> change directories to the home directory.
> - If the top of the script is #!/bin/zsh the issue does not happen

Thanks, it was very easy to reproduce, after I guessed what "feature"
this was related to --- we've had trouble with HOME not being set
in sh compatibility mode before.  You need to be in zsh for the ARGV0
trick to work:

(unset HOME; ARGV0=sh zsh -c cd)

> - The issue also does not happen on bash

Presumably this isn't really relevant?  I have a hard time imagining
why null dereferences in one shell should be connected with those in
another.  There's no code in common, but maybe that wasn't obvious.

The following includes a specific fix for HOME not being set and a
catch-all lower down if dir isn't set for some other reason (paranoia).

diff --git a/Src/builtin.c b/Src/builtin.c
index 0b39494..4144e80 100644
--- a/Src/builtin.c
+++ b/Src/builtin.c
@@ -880,8 +880,11 @@ cd_get_dest(char *nam, char **argv, int hard, int func)
 	    dir = nextnode(firstnode(dirstack));
 	if (dir)
 	    zinsertlinknode(dirstack, dir, getlinknode(dirstack));
-	else if (func != BIN_POPD)
+	else if (func != BIN_POPD) {
+	    if (!home)
+		zwarnnam(nam, "HOME not set");
 	    zpushnode(dirstack, ztrdup(home));
+	}
     } else if (!argv[1]) {
 	int dd;
 	char *end;
@@ -936,6 +939,10 @@ cd_get_dest(char *nam, char **argv, int hard, int func)
     if (!dir) {
 	dir = firstnode(dirstack);
     }
+    if (!dir || !getdata(dir)) {
+	DPUTS(1, "Directory not set, not detected early enough");
+	return NULL;
+    }
     if (!(dest = cd_do_chdir(nam, getdata(dir), hard))) {
 	if (!target)
 	    zsfree(getlinknode(dirstack));
diff --git a/Test/B01cd.ztst b/Test/B01cd.ztst
index 94447e7..8d4f095 100644
--- a/Test/B01cd.ztst
+++ b/Test/B01cd.ztst
@@ -137,6 +137,10 @@ F:something is broken.  But you already knew that.
 0:
 ?(eval):cd:3: not a directory: link_to_nonexistent
 
+ (unset HOME; ARGV0=sh $ZTST_testdir/../Src/zsh -c cd)
+1:Implicit cd with unset HOME.
+?zsh:cd:1: HOME not set
+
 %clean
 # This optional section cleans up after the test, if necessary,
 # e.g. killing processes etc.  This is in addition to the removal of *.tmp