diff options
| author | Peter Stephenson <p.w.stephenson@ntlworld.com> | 2023-05-13 21:49:07 +0100 |
|---|---|---|
| committer | Peter Stephenson <p.w.stephenson@ntlworld.com> | 2023-05-13 21:49:07 +0100 |
| commit | a95198e268ec1d432c37afc8dc4f8839acc0c8d0 (patch) | |
| tree | 6e2a7fe63abb80700a46955cb5425de7c9c8ba94 /Src/Modules | |
| parent | b4d1c756f50909b4a13e5c8fe5f26f71e9d54f63 (diff) | |
| download | zsh-a95198e268ec1d432c37afc8dc4f8839acc0c8d0.tar.gz zsh-a95198e268ec1d432c37afc8dc4f8839acc0c8d0.zip | |
51722: Safety for extracting elements of $historywords
Diffstat (limited to 'Src/Modules')
| -rw-r--r-- | Src/Modules/parameter.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/Src/Modules/parameter.c b/Src/Modules/parameter.c index 96a211c69..a05ea2fe4 100644 --- a/Src/Modules/parameter.c +++ b/Src/Modules/parameter.c @@ -1233,9 +1233,16 @@ histwgetfn(UNUSED(Param pm)) pushnode(l, getdata(n)); while (he) { + char *hstr = he->node.nam; + int len = strlen(hstr); for (iw = he->nwords - 1; iw >= 0; iw--) { - h = he->node.nam + he->words[iw * 2]; - e = he->node.nam + he->words[iw * 2 + 1]; + int wbegin = he->words[iw * 2]; + int wend = he->words[iw * 2 + 1]; + + if (wbegin < 0 || wbegin >= len || wend < 0 || wend > len) + break; + h = hstr + wbegin; + e = hstr + wend; sav = *e; *e = '\0'; addlinknode(l, dupstring(h)); |