From 9ac1dd9017b2b4acba4734f6f989b88da2ad7616 Mon Sep 17 00:00:00 2001 From: xiechengliang Date: Wed, 24 Nov 2021 19:15:25 +0800 Subject: [PATCH 2/2] ash: parser: Fix VSLENGTH parsing with trailing garbage Let's adopt Herbert Xu's patch, not waiting for it to reach dash git: hush already has a similar fix. backport from upstream: https://git.busybox.net/busybox/commit/?id=53a7a9cd8c15d64fcc2278cf8981ba526dfbe0d2 Signed-off-by: Denys Vlasenko --- shell/ash.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/shell/ash.c b/shell/ash.c index a33ab0626..1ca45f9c1 100644 --- a/shell/ash.c +++ b/shell/ash.c @@ -12635,7 +12635,7 @@ parsesub: { do { STPUTC(c, out); c = pgetc_eatbnl(); - } while (!subtype && isdigit(c)); + } while ((subtype == 0 || subtype == VSLENGTH) && isdigit(c)); } else if (c != '}') { /* $[{[#]][}] */ int cc = c; @@ -12665,11 +12665,6 @@ parsesub: { } else goto badsub; - if (c != '}' && subtype == VSLENGTH) { - /* ${#VAR didn't end with } */ - goto badsub; - } - if (subtype == 0) { static const char types[] ALIGN1 = "}-+?="; /* ${VAR...} but not $VAR or ${#VAR} */ @@ -12726,6 +12721,8 @@ parsesub: { #endif } } else { + if (subtype == VSLENGTH && c != '}') + subtype = 0; badsub: pungetc(); } -- 2.27.0