From dac15a10accc6921d1559d254ceed9fe9d092ddf Mon Sep 17 00:00:00 2001 From: Brian Foley Date: Tue, 1 Jan 2019 13:40:58 -0800 Subject: awk: Guard pointer chasing when parsing ternary expressions. Avoids an uninit pointer deref for some malformed ternary exprs. Add a test that would crash in busybox before this fix. Signed-off-by: Brian Foley Signed-off-by: Denys Vlasenko --- editors/awk.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'editors/awk.c') diff --git a/editors/awk.c b/editors/awk.c index b6d8cf203..f2b8b13eb 100644 --- a/editors/awk.c +++ b/editors/awk.c @@ -1265,7 +1265,7 @@ static node *parse_expr(uint32_t iexp) debug_printf_parse("%s(%x)\n", __func__, iexp); sn.info = PRIMASK; - sn.r.n = glptr = NULL; + sn.r.n = sn.a.n = glptr = NULL; xtc = TC_OPERAND | TC_UOPPRE | TC_REGEXP | iexp; while (!((tc = next_token(xtc)) & iexp)) { @@ -1287,6 +1287,7 @@ static node *parse_expr(uint32_t iexp) || ((t_info == vn->info) && ((t_info & OPCLSMASK) == OC_COLON)) ) { vn = vn->a.n; + if (!vn->a.n) syntax_error(EMSG_UNEXP_TOKEN); } if ((t_info & OPCLSMASK) == OC_TERNARY) t_info += P(6); -- cgit v1.2.3