From 91a375576d37bb4db1eca48e6bf5bac0db6cc3fa Mon Sep 17 00:00:00 2001 From: Herbert Xu Date: Tue, 3 Jan 2023 13:32:41 +0800 Subject: [PATCH] input: Eat rest of line upon reset MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Interactively, sh_error() doesn't terminate, so echo "|$(printf %10000s)echo bug" | sh -i would read the first 8KiB, see that it's invalid, then jump back to the parser, which would then read and execute the rest of the line as-if it were the next line. The fix for this is to explicitly consume the rest of the invalid line, so that the next line observed is /actually/ the next line. This is difficult to trigger accidentally right now, since we consume the entire icanon line buffer at once (provided it's <8k, which it ~always is interactively), so we always observe one line at a time, but the next patch would make even "| echo bug" blow up. Reported-by: наб Signed-off-by: Herbert Xu --- src/input.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/input.c b/src/input.c index ec075f5..cff15b5 100644 --- a/src/input.c +++ b/src/input.c @@ -77,6 +77,7 @@ INCLUDE INCLUDE INCLUDE "input.h" INCLUDE "error.h" +INCLUDE "syntax.h" INIT { basepf.nextc = basepf.buf = basebuf; @@ -85,9 +86,11 @@ INIT { RESET { /* clear input buffer */ - basepf.lleft = basepf.nleft = 0; - basepf.unget = 0; popallfiles(); + basepf.unget = 0; + while (basepf.lastc[0] != '\n' && + basepf.lastc[0] != PEOF) + pgetc(); } FORKRESET { -- 2.11.4.GIT