[PATCH] [BUILTIN] describe_command: fix incorrect path

[PATCH] [BUILTIN] describe_command: fix incorrect path

[Youfu Zhang]

$ PATH=/extra/path:/usr/sbin:/usr/bin:/sbin:/bin \
> sh -xc 'command -V ls; command -V ls; command -Vp ls; command -vp ls'
+ command -V ls
ls is /bin/ls
+ command -V ls
ls is a tracked alias for /bin/ls
+ command -Vp ls
ls is a tracked alias for (null)
+ command -vp ls
Segmentation fault (core dumped)

describe_command should respect `path' argument. Looking up in the hash table
may gives incorrect index in entry.u.index and finally causes incorrect output
or SIGSEGV.

Signed-off-by: Youfu Zhang <zhangyoufu@gmail.com>
---
 src/exec.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/src/exec.c b/src/exec.c
index ec0eadd..c4eeb58 100644
--- a/src/exec.c
+++ b/src/exec.c
@@ -767,14 +767,8 @@ describe_command(out, command, path, verbose)
 		goto out;
 	}
 
-	/* Then check if it is a tracked alias */
-	if ((cmdp = cmdlookup(command, 0)) != NULL) {
-		entry.cmdtype = cmdp->cmdtype;
-		entry.u = cmdp->param;
-	} else {
-		/* Finally use brute force */
-		find_command(command, &entry, DO_ABS, path);
-	}
+	/* Brute force */
+	find_command(command, &entry, DO_ABS, path);
 
 	switch (entry.cmdtype) {
 	case CMDNORMAL: {
-- 
2.8.4 (Apple Git-73)

Re: [PATCH] [BUILTIN] describe_command: fix incorrect path

[Harald van Dijk]

Hi,

On 26/05/17 09:04, Youfu Zhang wrote:
> $ PATH=/extra/path:/usr/sbin:/usr/bin:/sbin:/bin \
>> sh -xc 'command -V ls; command -V ls; command -Vp ls; command -vp ls'
> + command -V ls
> ls is /bin/ls
> + command -V ls
> ls is a tracked alias for /bin/ls
> + command -Vp ls
> ls is a tracked alias for (null)
> + command -vp ls
> Segmentation fault (core dumped)
> 
> describe_command should respect `path' argument. Looking up in the hash table
> may gives incorrect index in entry.u.index and finally causes incorrect output
> or SIGSEGV.

True, but only when a path is passed in. If the default path is used, 
looking up in the hash table is correct, and printing tracked aliases is 
intentional.

If it's desirable to drop that feature, then it should be dropped 
completely, code shouldn't be left in that can no longer be used. But 
it's possible to keep it working: how about this instead?

Signed-off-by: Harald van Dijk <harald@gigawatt.nl>
---
  src/exec.c | 13 +++++++++----
  1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/src/exec.c b/src/exec.c
index ec0eadd..1350da3 100644
--- a/src/exec.c
+++ b/src/exec.c
@@ -743,8 +743,6 @@ describe_command(out, command, path, verbose)
  	struct tblentry *cmdp;
  	const struct alias *ap;

-	path = path ?: pathval();
-
  	if (verbose) {
  		outstr(command, out);
  	}
@@ -767,8 +765,15 @@ describe_command(out, command, path, verbose)
  		goto out;
  	}

-	/* Then check if it is a tracked alias */
-	if ((cmdp = cmdlookup(command, 0)) != NULL) {
+	/* Then if the standard search path is used, check if it is a tracked 
alias.  */
+	if (path == NULL) {
+		path = pathval();
+		cmdp = cmdlookup(command, 0);
+	} else {
+		cmdp = NULL;
+	}
+
+	if (cmdp != NULL) {
  		entry.cmdtype = cmdp->cmdtype;
  		entry.u = cmdp->param;
  	} else {

Re: [PATCH] [BUILTIN] describe_command: fix incorrect path

[Youfu Zhang]

Your patch looks better than mine :)

Please consider post this patch to busybox as well.
Their ash has same code and same issue.

See http://lists.busybox.net/pipermail/busybox/2017-May/085459.html

On Fri, May 26, 2017 at 3:59 PM, Harald van Dijk <harald@gigawatt.nl> wrote:
> Hi,
>
> On 26/05/17 09:04, Youfu Zhang wrote:
>>
>> $ PATH=/extra/path:/usr/sbin:/usr/bin:/sbin:/bin \
>>>
>>> sh -xc 'command -V ls; command -V ls; command -Vp ls; command -vp ls'
>>
>> + command -V ls
>> ls is /bin/ls
>> + command -V ls
>> ls is a tracked alias for /bin/ls
>> + command -Vp ls
>> ls is a tracked alias for (null)
>> + command -vp ls
>> Segmentation fault (core dumped)
>>
>> describe_command should respect `path' argument. Looking up in the hash
>> table
>> may gives incorrect index in entry.u.index and finally causes incorrect
>> output
>> or SIGSEGV.
>
>
> True, but only when a path is passed in. If the default path is used,
> looking up in the hash table is correct, and printing tracked aliases is
> intentional.
>
> If it's desirable to drop that feature, then it should be dropped
> completely, code shouldn't be left in that can no longer be used. But it's
> possible to keep it working: how about this instead?
>
> Signed-off-by: Harald van Dijk <harald@gigawatt.nl>
> ---
>  src/exec.c | 13 +++++++++----
>  1 file changed, 9 insertions(+), 4 deletions(-)
>
> diff --git a/src/exec.c b/src/exec.c
> index ec0eadd..1350da3 100644
> --- a/src/exec.c
> +++ b/src/exec.c
> @@ -743,8 +743,6 @@ describe_command(out, command, path, verbose)
>         struct tblentry *cmdp;
>         const struct alias *ap;
>
> -       path = path ?: pathval();
> -
>         if (verbose) {
>                 outstr(command, out);
>         }
> @@ -767,8 +765,15 @@ describe_command(out, command, path, verbose)
>                 goto out;
>         }
>
> -       /* Then check if it is a tracked alias */
> -       if ((cmdp = cmdlookup(command, 0)) != NULL) {
> +       /* Then if the standard search path is used, check if it is a
> tracked alias.  */
> +       if (path == NULL) {
> +               path = pathval();
> +               cmdp = cmdlookup(command, 0);
> +       } else {
> +               cmdp = NULL;
> +       }
> +
> +       if (cmdp != NULL) {
>                 entry.cmdtype = cmdp->cmdtype;
>                 entry.u = cmdp->param;
>         } else {