about summary refs log tree commit diff
diff options
context:
space:
mode:
authorPeter Stephenson <pws@users.sourceforge.net>2011-05-02 12:32:41 +0000
committerPeter Stephenson <pws@users.sourceforge.net>2011-05-02 12:32:41 +0000
commit17e3f742f15313d7f44537f03bf85cf6e6ed4216 (patch)
tree0ff65184020e736dab2416c862fc886b8ced3f36
parentf16ab40c0632cd388180eecf91d414d257e85113 (diff)
downloadzsh-17e3f742f15313d7f44537f03bf85cf6e6ed4216.tar.gz
zsh-17e3f742f15313d7f44537f03bf85cf6e6ed4216.tar.xz
zsh-17e3f742f15313d7f44537f03bf85cf6e6ed4216.zip
29129: reading of end of fd array
-rw-r--r--ChangeLog7
-rw-r--r--Src/exec.c9
2 files changed, 11 insertions, 5 deletions
diff --git a/ChangeLog b/ChangeLog
index 5b4de11da..38e927e78 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2011-05-02  Peter Stephenson  <p.w.stephenson@ntlworld.com>
+
+	* 29129: Src/exec.c: reading off end of file descriptor array
+	noticed by Vincent.
+
 2011-05-01  Peter Stephenson  <p.w.stephenson@ntlworld.com>
 
 	* Haakon Riiser: unposted: Completion/Unix/Command/_ffmpeg: more
@@ -14555,5 +14560,5 @@
 
 *****************************************************
 * This is used by the shell to define $ZSH_PATCHLEVEL
-* $Revision: 1.5271 $
+* $Revision: 1.5272 $
 *****************************************************
diff --git a/Src/exec.c b/Src/exec.c
index 9c72c68af..a06f2f3ac 100644
--- a/Src/exec.c
+++ b/Src/exec.c
@@ -3008,10 +3008,11 @@ execcmd(Estate state, int input, int output, int how, int last1)
 		if (!checkclobberparam(fn))
 		    fil = -1;
 		else if (fn->fd2 > 9 &&
-		    ((fdtable[fn->fd2] != FDT_UNUSED &&
-		      fdtable[fn->fd2] != FDT_EXTERNAL) ||
-		     fn->fd2 == coprocin ||
-		     fn->fd2 == coprocout)) {
+			 (fn->fd2 > max_zsh_fd ||
+			  (fdtable[fn->fd2] != FDT_UNUSED &&
+			   fdtable[fn->fd2] != FDT_EXTERNAL) ||
+			  fn->fd2 == coprocin ||
+			  fn->fd2 == coprocout)) {
 		    fil = -1;
 		    errno = EBADF;
 		} else {