Zsh Mailing List Archive
Messages sorted by:
Reverse Date,
Date,
Thread,
Author
Re: [BUG] Two vulnerabilities in zsh
Change of plan: I've done the fix for the original problem the same way
I did the fix for the follow up. That's because I can no longer convince
myself that a String token last in the buffer is necessarily the very
start of a $-expansion --- it may be true, I'm just not sure --- and we
might as well be consistent in the two case.
The reason I did it that way to begin with was that way back when we
could only back up one input character. But that hasn't been true since
I rewrote the input layer (between specific I/O types and history) some
time ago now.
The test cases are fixed --- there aren't any trailing spaces, even if
they show up in the patch.
pws
diff --git a/Src/lex.c b/Src/lex.c
index a541defe6..37fcec3e2 100644
--- a/Src/lex.c
+++ b/Src/lex.c
@@ -541,6 +541,17 @@ cmd_or_math_sub(void)
{
int c = hgetc(), ret;
+ if (c == '\\') {
+ c = hgetc();
+ if (c != '\n') {
+ hungetc(c);
+ hungetc('\\');
+ lexstop = 0;
+ return skipcomm() ? CMD_OR_MATH_ERR : CMD_OR_MATH_CMD;
+ }
+ c = hgetc();
+ }
+
if (c == '(') {
int lexpos = (int)(lexbuf.ptr - tokstr);
add(Inpar);
@@ -998,6 +1009,16 @@ gettokstr(int c, int sub)
break;
case LX2_STRING:
e = hgetc();
+ if (e == '\\') {
+ e = hgetc();
+ if (e != '\n') {
+ hungetc(e);
+ hungetc('\\');
+ lexstop = 0;
+ break;
+ }
+ e = hgetc();
+ }
if (e == '[') {
cmdpush(CS_MATHSUBST);
add(String);
diff --git a/Test/D04parameter.ztst b/Test/D04parameter.ztst
index 6d2dd0d99..e51c955ee 100644
--- a/Test/D04parameter.ztst
+++ b/Test/D04parameter.ztst
@@ -2662,7 +2662,25 @@ F:behavior, see http://austingroupbugs.net/view.php?id=888
-f:regression test for workers/45843#1
?(eval):1: bad substitution
-# Temporarily using the 'D' flag because it generates a "BUG:" message in
-# debug builds only.
$ZTST_testdir/../Src/zsh -fc $'$\\\n('
-1Df:regression test for workers/45843#2: escaped newline in command substitution start token
+1:regression test for workers/45843#2: escaped newline in command substitution start token
+?zsh:2: parse error near `$('
+
+# `
+
+ eval $'echo $\\\n(printf "%d\\n" $(( 4 + 2 )) )'
+0:Normal command substitution with escaped newline
+>6
+
+ eval $'echo $\\\n(( 14 / 2 ))'
+0:Normal math eval with escaped newline after $
+>7
+
+ eval $'echo $(\\\n( 15 / 3 ))'
+0:Normal math eval with escaped newline after $(
+>5
+
+ function '*' { echo What a star; }
+ eval 'echo $(\*)'
+0:Backslash character other than newline is normal after $(
+>What a star
Messages sorted by:
Reverse Date,
Date,
Thread,
Author