#1050230 dash: Missing argument after test -o gives a Segmentation fault

Package:
dash
Source:
dash
Description:
POSIX-compliant shell
Submitter:
Martin Simmons
Date:
2023-08-22 13:09:07 UTC
Severity:
normal
#1050230#5
Date:
2023-08-22 12:56:24 UTC
From:
To:
Dear Maintainer,

The following incorrect use of test -o causes a Segmentation fault for me:

$ dash -c 'echo baz 987654321abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 | while read field data; do test "$field" = foo -o; done'
Segmentation fault (core dumped)

The backtrace in gdb is below.

The crashing instruction in __strcmp_sse2_unaligned is trying to load from
%rdi, but that contains bytes from the long string in the argument to echo.

gdb> bt
#0  __strcmp_sse2_unaligned () at ../sysdeps/x86_64/multiarch/strcmp-sse2-unaligned.S:31
#1  0x000056293a93170d in getop (s=<optimized out>) at bltin/test.c:175
#2  t_lex (tp=tp@entry=0x56293bd90380) at bltin/test.c:448
#3  0x000056293a931820 in aexpr (n=<optimized out>) at bltin/test.c:273
#4  oexpr (n=<optimized out>) at bltin/test.c:256
#5  0x000056293a931e7f in testcmd (argc=<optimized out>, argv=0x56293bd90358) at bltin/test.c:232
#6  0x000056293a923d77 in evalbltin (cmd=0x56293a93ba18 <builtincmd+696>, argc=argc@entry=0x5, argv=argv@entry=0x56293bd90350, flags=flags@entry=0x0) at eval.c:969
#7  0x000056293a92442a in evalcommand (cmd=0x56293bd90148, flags=0x0) at eval.c:912
#8  0x000056293a92327e in evaltree (n=0x56293bd90148, flags=flags@entry=0x0) at eval.c:303
#9  0x000056293a9238e0 in evalloop (n=0x56293a93e988 <stackbase+424>, flags=0x0) at eval.c:400
#10 0x000056293a923231 in evaltree (n=0x56293a93e988 <stackbase+424>, flags=flags@entry=0x1) at eval.c:303
#11 0x000056293a923630 in evaltreenr (flags=0x1, n=<optimized out>) at eval.c:349
#12 evalpipe (n=0x56293a93e950 <stackbase+368>, flags=0x1) at eval.c:601
#13 0x000056293a92327e in evaltree (n=n@entry=0x56293a93e950 <stackbase+368>, flags=0x0) at eval.c:303
#14 0x000056293a923c6a in evalstring (s=0x56293a93e7e8 <stackbase+8> "echo baz 987654321abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 | while read field data; do test \"$field\" = foo -o; done", flags=flags@entry=0x0) at eval.c:185
#15 0x000056293a92167f in main (argc=0x3, argv=0x7ffc474c2c88) at main.c:177
gdb> x/i $pc
=> 0x7fb4664191fa <__strcmp_sse2_unaligned+26>:	movdqu (%rdi),%xmm1
gdb> p/x $rdi
$1 = 0x5958575655545352
gdb>

I suspect the problem is that there is no check for the end of the arguments
in oexpr (and related functions).