Running the following kills the shell with 'Out of memory':
set x='a/b c/d.e'
echo $x:q:h
In sh.lex.c, it was checking if any / was in the string, but after unquoting
the candidate string. Next, it was trying to find the last /, but this
time on the quoted string (so it wouldn't find it). It would then try
to copy a string of size >>really large number<<, which failed.
Rewrote the code that handles :h and :t to be like the code for :r and
:e, which avoids the crash and makes it consistent.
Added tests for executing :h, :t, :r, :e on a :q'uoted string.
zoulasc
commented
3 years ago
Running the following kills the shell with 'Out of memory':
In sh.lex.c, it was checking if any / was in the string, but after unquoting the candidate string. Next, it was trying to find the last /, but this time on the quoted string (so it wouldn't find it). It would then try to copy a string of size >>really large number<<, which failed.
Rewrote the code that handles :h and :t to be like the code for :r and :e, which avoids the crash and makes it consistent.
Added tests for executing :h, :t, :r, :e on a :q'uoted string.
See #30