From 7bc3d39695728c6257a95bc2d75e80d3e2431c8b Mon Sep 17 00:00:00 2001 From: Denys Vlasenko Date: Sat, 17 Sep 2016 20:53:47 +0200 Subject: ash: add a FIXME for bug 9246 Signed-off-by: Denys Vlasenko --- shell/ash.c | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'shell/ash.c') diff --git a/shell/ash.c b/shell/ash.c index 789a81cc3..790367bd8 100644 --- a/shell/ash.c +++ b/shell/ash.c @@ -11659,9 +11659,18 @@ parsebackq: { str = NULL; savelen = out - (char *)stackblock(); if (savelen > 0) { + /* + * FIXME: this can allocate very large block on stack and SEGV. + * Example: + * echo "..<100kbytes>..`true` $(true) `true` ..." + * alocates 100kb for every command subst. With about + * a hundred command substitutions stack overflows. + * With larger prepended string, SEGV happens sooner. + */ str = alloca(savelen); memcpy(str, stackblock(), savelen); } + if (oldstyle) { /* We must read until the closing backquote, giving special * treatment to some slashes, and then push the string and -- cgit v1.2.3