Skip to content

Commit

Permalink
Re-fix use of strdup on a NULL pointer (re: 9a9da2c) (#718)
Browse files Browse the repository at this point in the history
Thank you @lzaoral for debugging this issue and creating this
reproducer:

$ tty   # check that the shell is connected to a pseudoterminal
/dev/pts/4
$ mkdir /var/tmp/chroottest
$ dnf --releasever=39 --installroot=/var/tmp/chroottest install ksh
$ echo "/dev/udp/127.0.0.1/514;0;104" |
        sudo tee /var/tmp/chroottest/etc/ksh_audit
$ sudo chroot /var/tmp/chroottest /bin/ksh -lic 'exit 0'
(ksh segfaults)

Analysis: On Linux, ttyname(3)[*] may fail if:

* EBADF  Bad file descriptor.
* ENODEV fd refers to a slave pseudoterminal device but the
         corresponding pathname could not be found [...].
* ENOTTY fd does not refer to a terminal device.

Calling isatty(3) before ttyname(3) only prevents the first and
third cases.

src/cmd/ksh93/edit/history.c: sh_histinit():
- To catch the second case, let's call ttyname(2) directly, check
  for NULL and remove the redundant isatty() call.

[*] https://man7.org/linux/man-pages/man3/ttyname.3.html
  • Loading branch information
vmihalko authored and McDutchie committed Feb 8, 2024
1 parent ec3c3c1 commit 9eb8532
Show file tree
Hide file tree
Showing 3 changed files with 9 additions and 2 deletions.
5 changes: 5 additions & 0 deletions NEWS
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,11 @@ This documents significant changes in the dev branch of ksh 93u+m.
For full details, see the git log at: https://github.com/ksh93/ksh
Uppercase BUG_* IDs are shell bug IDs as used by the Modernish shell library.

2024-02-08:

- Fixed an init-time crash that may occur if standard error is on a terminal,
but the path to its tty device can't be found (e.g., in a chroot situation).

2024-02-06:

- Fixed a regression introduced on 2023-03-04 that caused ksh to lock up
Expand Down
4 changes: 3 additions & 1 deletion src/cmd/ksh93/edit/history.c
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
* Johnothan King <[email protected]> *
* hyenias <[email protected]> *
* Govind Kamat <[email protected]> *
* Vincent Mihalkovic <[email protected]> *
* *
***********************************************************************/
/*
Expand Down Expand Up @@ -353,7 +354,8 @@ int sh_histinit(void)
if(fd>=0)
{
fcntl(fd,F_SETFD,FD_CLOEXEC);
hp->tty = sh_strdup(isatty(2)?ttyname(2):"notty");
const char* tty = ttyname(2);
hp->tty = sh_strdup(tty?tty:"notty");
hp->auditfp = sfnew(NULL,NULL,-1,fd,SF_WRITE);
}
}
Expand Down
2 changes: 1 addition & 1 deletion src/cmd/ksh93/include/version.h
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@

#define SH_RELEASE_FORK "93u+m" /* only change if you develop a new ksh93 fork */
#define SH_RELEASE_SVER "1.1.0-alpha" /* semantic version number: https://semver.org */
#define SH_RELEASE_DATE "2024-02-06" /* must be in this format for $((.sh.version)) */
#define SH_RELEASE_DATE "2024-02-08" /* must be in this format for $((.sh.version)) */
#define SH_RELEASE_CPYR "(c) 2020-2024 Contributors to ksh " SH_RELEASE_FORK

/* Scripts sometimes field-split ${.sh.version}, so don't change amount of whitespace. */
Expand Down

0 comments on commit 9eb8532

Please sign in to comment.