From a95198e268ec1d432c37afc8dc4f8839acc0c8d0 Mon Sep 17 00:00:00 2001 From: Peter Stephenson Date: Sat, 13 May 2023 21:49:07 +0100 Subject: 51722: Safety for extracting elements of $historywords --- ChangeLog | 5 +++++ Src/Modules/parameter.c | 11 +++++++++-- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 18bc4a698..85fc1de96 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +2023-05-13 Peter Stephenson + + * 51722: Src/Modules/parameter.c: Add safety to extracting + elements of $historywords. + 2023-05-13 Oliver Kiddle * 51738: Doc/Zsh/mod_pcre.yo, Src/Modules/pcre.c, diff --git a/Src/Modules/parameter.c b/Src/Modules/parameter.c index 96a211c69..a05ea2fe4 100644 --- a/Src/Modules/parameter.c +++ b/Src/Modules/parameter.c @@ -1233,9 +1233,16 @@ histwgetfn(UNUSED(Param pm)) pushnode(l, getdata(n)); while (he) { + char *hstr = he->node.nam; + int len = strlen(hstr); for (iw = he->nwords - 1; iw >= 0; iw--) { - h = he->node.nam + he->words[iw * 2]; - e = he->node.nam + he->words[iw * 2 + 1]; + int wbegin = he->words[iw * 2]; + int wend = he->words[iw * 2 + 1]; + + if (wbegin < 0 || wbegin >= len || wend < 0 || wend > len) + break; + h = hstr + wbegin; + e = hstr + wend; sav = *e; *e = '\0'; addlinknode(l, dupstring(h)); -- cgit 1.4.1