diff mbox series

expand: Fix double-decrement in argstr

Message ID 20190225060031.x5ckegfrskba6zrc@gondor.apana.org.au (mailing list archive)
State Accepted
Delegated to: Herbert Xu
Headers show
Series expand: Fix double-decrement in argstr | expand

Commit Message

Herbert Xu Feb. 25, 2019, 6 a.m. UTC 
On Sat, Feb 16, 2019 at 10:26:23PM +0000, Martijn Dekker wrote:
> For unset foo:
> 
> dash-git
> $ src/dash -c 'set -- ${foo- bar }; echo "[$1]"'
> [bar ]
> 
> Release versions of dash and all other shells output:
> [bar]
> 
> The change in behaviour appears to have been introduced by commit
> 3cd5386 ("expand: Do not reprocess data when expanding words").

Thanks for catching this!

---8<---
Due to a double decrement in argstr we may miss field separators
at the end of a word in certain situations.

Reported-by: Martijn Dekker <martijn@inlv.org>
Fixes: 3cd538634f71 ("expand: Do not reprocess data when...")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
diff mbox series

Patch

diff --git a/src/expand.c b/src/expand.c
index af9cac9..e57efa6 100644
--- a/src/expand.c
+++ b/src/expand.c
@@ -285,7 +285,7 @@  start:
 			q = stnputs(p, length, expdest);
 			q[-1] &= end - 1;
 			expdest = q - (flag & EXP_WORD ? end : 0);
-			newloc = expdest - (char *)stackblock() - end;
+			newloc = q - (char *)stackblock() - end;
 			if (breakall && !inquotes && newloc > startloc) {
 				recordregion(startloc, newloc, 0);
 			}