From: jaredy <jaredy@openbsd.org>
Date: Wed, 23 Jul 2008 16:34:38 +0000 (+0000)
Subject: fix stack abuse in the `time' commmand, using alloc()'d memory instead.
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=0d1f5adac02c0962f687a20d8669654911ea1d3d;p=openbsd

fix stack abuse in the `time' commmand, using alloc()'d memory instead.

reported by Thorsten Glaser, thanks.

ok millert@, earlier version miod@
---

diff --git a/bin/ksh/c_sh.c b/bin/ksh/c_sh.c
index 901e206fd2b..ae5c3cd8352 100644
--- a/bin/ksh/c_sh.c
+++ b/bin/ksh/c_sh.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: c_sh.c,v 1.37 2007/09/03 13:54:23 otto Exp $	*/
+/*	$OpenBSD: c_sh.c,v 1.38 2008/07/23 16:34:38 jaredy Exp $	*/
 
 /*
  * built-in Bourne commands
@@ -719,7 +719,6 @@ timex(struct op *t, int f)
 	struct timeval usrtime, systime, tv0, tv1;
 	int tf = 0;
 	extern struct timeval j_usrtime, j_systime; /* computed by j_wait */
-	char opts[1];
 
 	gettimeofday(&tv0, NULL);
 	getrusage(RUSAGE_SELF, &ru0);
@@ -735,11 +734,9 @@ timex(struct op *t, int f)
 		 */
 		timerclear(&j_usrtime);
 		timerclear(&j_systime);
-		if (t->left->type == TCOM)
-			t->left->str = opts;
-		opts[0] = 0;
 		rv = execute(t->left, f | XTIME);
-		tf |= opts[0];
+		if (t->left->type == TCOM)
+			tf |= t->left->str[0];
 		gettimeofday(&tv1, NULL);
 		getrusage(RUSAGE_SELF, &ru1);
 		getrusage(RUSAGE_CHILDREN, &cru1);
diff --git a/bin/ksh/syn.c b/bin/ksh/syn.c
index dc1d49ed61a..9b7451a318e 100644
--- a/bin/ksh/syn.c
+++ b/bin/ksh/syn.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: syn.c,v 1.27 2006/04/10 14:38:59 jaredy Exp $	*/
+/*	$OpenBSD: syn.c,v 1.28 2008/07/23 16:34:38 jaredy Exp $	*/
 
 /*
  * shell parser (C version)
@@ -364,6 +364,11 @@ get_command(int cf)
 	case TIME:
 		syniocf &= ~(KEYWORD|ALIAS);
 		t = pipeline(0);
+		if (t) {
+			t->str = alloc(2, ATEMP);
+			t->str[0] = '\0'; /* TF_* flags */
+			t->str[1] = '\0';
+		}
 		t = block(TTIME, t, NOBLOCK, NOWORDS);
 		break;