From 9a20db4b5257d56d2d6030a20ad42f5e0dc9f25b Mon Sep 17 00:00:00 2001 From: Robin Haberkorn Date: Mon, 28 Nov 2022 06:05:48 +0300 Subject: fixed a number of crashes due to empty string arguments or uninitialized registers * An empty but valid teco_string_t can contain NULL pointers. More precisely, a state's done_cb() can be invoked with such empty strings in case of empty string arguments. Also a registers get_string() can return the NULL pointer for existing registers with uninitialized string parts. * In all of these cases, the language should treat "uninitialized" strings exactly like empty strings. * Not doing so, resulted in a number of vulnerabilities. * EN$$ crashed if "_" was uninitialized * The ^E@q and ^ENq string building constructs would crash for existing but uninitialized registers q. * ?$ would crash * ESSETILEXER$$ would crash * This is now fixed. Test cases have been added. * I cannot guarantee that I have found all such cases. Generally, it might be wise to change our definitions and make sure that every teco_string_t must have an associated heap object to be valid. All functions returning pointer+length pairs should consequently also never return NULL pointers. --- src/glob.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'src/glob.c') diff --git a/src/glob.c b/src/glob.c index e67df7b..6aea02f 100644 --- a/src/glob.c +++ b/src/glob.c @@ -46,6 +46,9 @@ TECO_DECLARE_STATE(teco_state_glob_filename); void teco_globber_init(teco_globber_t *ctx, const gchar *pattern, GFileTest test) { + if (!pattern) + pattern = ""; + memset(ctx, 0, sizeof(*ctx)); ctx->test = test; @@ -114,6 +117,9 @@ teco_globber_clear(teco_globber_t *ctx) gchar * teco_globber_escape_pattern(const gchar *pattern) { + if (!pattern) + return g_strdup(""); + gsize escaped_len = 1; gchar *escaped, *pout; -- cgit v1.2.3