mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2025-02-04 17:15:50 +00:00
Code Issues Releases Activity

Fix sed(1) in the case where a last line is specified and hold space is not

Browse Source 
specified, and then the first part of the pattern space is deleted, when
there are two or more input lines, as this results in subtraction of one from
an unsigned integral value of '0'.  That bogus value is used in one case
for a loop (that will run far too many times in this case) and a function to
search for a value within a specified range of memory, however now the range
of memory is obscenely large and a segmentation fault will occur.  This is
fixed by checking for and appropriately handling a nil pattern space as if
the specified search in memory failed, as indeed it obviously will with nil
pattern space.

Submitted by:	Tim J. Robbins <tim@robbins.dropbear.id.au>
PR:		bin/34813
Reviewed by:	mike
MFC after:	1 day
This commit is contained in:
Juli Mallett 2002-04-07 02:29:56 +00:00
parent 856bef3c17
commit ae17860040
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=94012
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
usr.bin/sed/process.c
View File

@ -136,7 +136,8 @@ redirect:
case 'D':
if (pd)
goto new;
if ((p = memchr(ps, '\n', psl - 1)) == NULL) {
if (psl == 0 ||
(p = memchr(ps, '\n', psl - 1)) == NULL) {
pd = 1;
goto new;
} else {
@ -188,7 +189,8 @@ redirect:
case 'P':
if (pd)
break;
if ((p = memchr(ps, '\n', psl - 1)) != NULL) {
if (psl != 0 &&
(p = memchr(ps, '\n', psl - 1)) != NULL) {
oldpsl = psl;
psl = (p + 1) - ps;
}
@ -240,7 +242,7 @@ redirect:
HS = tspace;
break;
case 'y':
if (pd)
if (pd || psl == 0)
break;
for (p = ps, len = psl; --len; ++p)
*p = cp->u.y[(unsigned char)*p];