commit e4b913866b759d4744b8636ac73a8775447dd28e
from: Igor Burago <ib@iburago.org>
via: Dan Cross <crossd@gmail.com>
date: Tue Sep 06 17:21:23 2022 UTC

plumber: fail on buffer exhaustion or runaway quotes in string expansion

commit - a4af25bc0da1777f91ea0ae2674a4e64c7d1c83e
commit + e4b913866b759d4744b8636ac73a8775447dd28e
blob - 6e9b2c6322fbd12bf341228a4a85fd710c5a8780
blob + 2cb4afe9a569d13281b34918bb9e9a4a08078079
--- src/cmd/plumb/rules.c
+++ src/cmd/plumb/rules.c
@@ -287,6 +287,16 @@ dollar(Exec *e, char *s, int *namelen)
 	}
 
 	return variable(s, n);
+}
+
+static void
+ruleerror(char *msg)
+{
+	if(parsing){
+		parsing = 0;
+		parseerror("%s", msg);
+	}
+	error("%s", msg);
 }
 
 /* expand one blank-terminated string, processing quotes and $ signs */
@@ -294,17 +304,20 @@ char*
 expand(Exec *e, char *s, char **ends)
 {
 	char *p, *ep, *val;
-	int namelen, quoting;
+	int namelen, vallen, quoting, inputleft;
 
 	p = ebuf;
 	ep = ebuf+sizeof ebuf-1;
 	quoting = 0;
-	while(p<ep && *s!='\0' && (quoting || (*s!=' ' && *s!='\t'))){
+	for(;;){
+		inputleft = (*s!='\0' && (quoting || (*s!=' ' && *s!='\t')));
+		if(!inputleft || p==ep)
+			break;
 		if(*s == '\''){
 			s++;
 			if(!quoting)
 				quoting = 1;
-			else  if(*s == '\''){
+			else if(*s == '\''){
 				*p++ = '\'';
 				s++;
 			}else
@@ -321,12 +334,17 @@ expand(Exec *e, char *s, char **ends)
 			*p++ = '$';
 			continue;
 		}
-		if(ep-p < strlen(val))
-			return "string-too-long";
+		vallen = strlen(val);
+		if(ep-p < vallen)
+			break;
 		strcpy(p, val);
-		p += strlen(val);
+		p += vallen;
 		s += namelen;
 	}
+	if(inputleft)
+		ruleerror("expanded string too long");
+	else if(quoting)
+		ruleerror("runaway quoted string literal");
 	if(ends)
 		*ends = s;
 	*p = '\0';
@@ -336,11 +354,7 @@ expand(Exec *e, char *s, char **ends)
 void
 regerror(char *msg)
 {
-	if(parsing){
-		parsing = 0;
-		parseerror("%s", msg);
-	}
-	error("%s", msg);
+	ruleerror(msg);
 }
 
 void