#7 (typeset -Tp) (was Re: Zsh - Multiple DoS Vulnerabilities)

[Oliver Kiddle <okiddle@xxxxxxxxxxx>]

Bart wrote:
> >     #7 Invalid read from *hasher *in *hashtable.c*
> >     POC folder: *07_hasher_(hashtable.c_85)*

> +2> typeset -priTt CeE e
>
> and then just goes away until killed.  Only that final typeset is
> necessary to reproduce the bug, the rest is irrelevant.

Actually all it needs is the combination of -T and -p along with
variables that aren't already tied.

With other relevant branches of bin_typeset() for things like
typeset -pi, we check for OPT_ISSET(ops, 'p') early and don't call
typeset_single(). (-m is an exception to this).

An alternative to the following patch would be to simply print an error.
This would just involve the -p test joining the -m test on the next
lines after the final bit of context. However, the behaviour as per this
patch is more consistent with other meaningless typeset combinations
like -pi and -pF.

I'm fairly certain that the second part of the patch renders the lines
removed in the first part as dead code but it'd be good if someone else
could check my logic which is as follows: Given -p, typeset_single() is
only now called when -m is set. usepm will always then be true because
with -m, pm will always be set and never with PM_UNSET. So we go into
the if (usepm) block on line 2193 which has early returns on every
branch.

Oliver


diff --git a/Src/builtin.c b/Src/builtin.c
index 49f017046..ca0ce35f5 100644
--- a/Src/builtin.c
+++ b/Src/builtin.c
@@ -2583,9 +2583,6 @@ typeset_single(char *cname, char *pname, Param pm, UNUSED(int func),
     }
     pm->node.flags |= (on & PM_READONLY);
 
-    if (OPT_ISSET(ops,'p'))
-	paramtab->printnode(&pm->node, PRINT_TYPESET);
-
     return pm;
 }
 
@@ -2714,7 +2711,7 @@ bin_typeset(char *name, char **argv, LinkList assigns, Options ops, int func)
 	(!isset(GLOBALEXPORT) && !OPT_ISSET(ops,'g')))
 	on |= PM_LOCAL;
 
-    if (on & PM_TIED) {
+    if ((on & PM_TIED) && !OPT_ISSET(ops, 'p')) {
 	Param apm;
 	struct asgment asg0, asg2;
 	char *oldval = NULL, *joinstr;