diff options
| author | Samuel Holland <samuel@sholland.org> | 2016-03-20 11:13:21 -0700 |
|---|---|---|
| committer | Rob Landley <rob@landley.net> | 2016-03-25 14:24:25 -0500 |
| commit | e223cca4f66bf2e201b21869304dc63befbbf9be (patch) | |
| tree | dc1581cf98284210de9cb9b2cf998211fe4fc9f6 | |
| parent | a8233286378a0254ade5ca2088a7bcc6a686b428 (diff) | |
| download | toybox-e223cca4f66bf2e201b21869304dc63befbbf9be.tar.gz | |
basename: fix segfault on null input; add tests
When passed an empty string, glibc's basename() returns a pointer to the
string "." in read-only memory. If an empty suffix is given, it fits
the condition of being shorter than the path, so we try to overwrite the
null byte and crash. Fix this by just ignoring empty suffixes; they
don't do anything anyway.
| -rwxr-xr-x | tests/basename.test | 3 | ||||
| -rw-r--r-- | toys/posix/basename.c | 2 |
2 files changed, 4 insertions, 1 deletions
diff --git a/tests/basename.test b/tests/basename.test index 9d3b2961..ab2cc20a 100755 --- a/tests/basename.test +++ b/tests/basename.test @@ -21,3 +21,6 @@ testing "reappearing suffix 2" "basename a.txt.old .txt" "a.txt.old\n" "" "" # A suffix should be a real suffix, only a the end. testing "invalid suffix" "basename isthisasuffix? suffix" "isthisasuffix?\n" "" "" + +# Zero-length suffix +testing "zero-length suffix" "basename a/b/c ''" "c\n" "" "" diff --git a/toys/posix/basename.c b/toys/posix/basename.c index 1a27a23b..c123cc79 100644 --- a/toys/posix/basename.c +++ b/toys/posix/basename.c @@ -23,7 +23,7 @@ void basename_main(void) char *base = basename(*toys.optargs), *suffix = toys.optargs[1]; // chop off the suffix if provided - if (suffix) { + if (suffix && *suffix) { long bl = strlen(base), sl = strlen(suffix); char *s = base + bl - sl; |