From 8bef63a910cb7baa82d20e0da695028c3c5dd7fc Mon Sep 17 00:00:00 2001
From: jilles <jilles@ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f>
Date: Sun, 13 Sep 2015 13:31:51 +0000
Subject: [PATCH] MFC r287081: sh: Don't create bad parse result when
 postponing a bad substitution error.

An invalid substitution like ${var@} does not cause a parse error but is
stored in the intermediate representation, to be written as part of the
error message. If there is a CTL* byte in the stored part, this confuses
some code such as the code to skip an unused alternative such as in
${var-alternative}.

To keep things simple, do not store CTL* bytes.

Found with afl-fuzz.


git-svn-id: svn://svn.freebsd.org/base/stable/10@287749 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f
---
 bin/sh/parser.c                     | 5 +++--
 bin/sh/tests/errors/Makefile        | 2 ++
 bin/sh/tests/errors/bad-parm-exp7.0 | 4 ++++
 bin/sh/tests/errors/bad-parm-exp8.0 | 4 ++++
 4 files changed, 13 insertions(+), 2 deletions(-)
 create mode 100644 bin/sh/tests/errors/bad-parm-exp7.0
 create mode 100644 bin/sh/tests/errors/bad-parm-exp8.0

diff --git a/bin/sh/parser.c b/bin/sh/parser.c
index e6e9f82cc..b577a8a9d 100644
--- a/bin/sh/parser.c
+++ b/bin/sh/parser.c
@@ -1671,7 +1671,7 @@ varname:
 				pungetc();
 			else if (c == '\n' || c == PEOF)
 				synerror("Unexpected end of line in substitution");
-			else
+			else if (BASESYNTAX[c] != CCTL)
 				USTPUTC(c, out);
 		}
 		if (subtype == 0) {
@@ -1687,7 +1687,8 @@ varname:
 						synerror("Unexpected end of line in substitution");
 					if (flags == VSNUL)
 						STPUTC(':', out);
-					STPUTC(c, out);
+					if (BASESYNTAX[c] != CCTL)
+						STPUTC(c, out);
 					subtype = VSERROR;
 				} else
 					subtype = p - types + VSNORMAL;
diff --git a/bin/sh/tests/errors/Makefile b/bin/sh/tests/errors/Makefile
index 9f8b0f204..ab04f1475 100644
--- a/bin/sh/tests/errors/Makefile
+++ b/bin/sh/tests/errors/Makefile
@@ -17,6 +17,8 @@ FILES+=		bad-parm-exp3.2 bad-parm-exp3.2.stderr
 FILES+=		bad-parm-exp4.2 bad-parm-exp4.2.stderr
 FILES+=		bad-parm-exp5.2 bad-parm-exp5.2.stderr
 FILES+=		bad-parm-exp6.2 bad-parm-exp6.2.stderr
+FILES+=		bad-parm-exp7.0
+FILES+=		bad-parm-exp8.0
 FILES+=		option-error.0
 FILES+=		redirection-error.0
 FILES+=		redirection-error2.2
diff --git a/bin/sh/tests/errors/bad-parm-exp7.0 b/bin/sh/tests/errors/bad-parm-exp7.0
new file mode 100644
index 000000000..b8562fbed
--- /dev/null
+++ b/bin/sh/tests/errors/bad-parm-exp7.0
@@ -0,0 +1,4 @@
+# $FreeBSD$
+
+v=1
+eval ": $(printf '${v-${\372}}')"
diff --git a/bin/sh/tests/errors/bad-parm-exp8.0 b/bin/sh/tests/errors/bad-parm-exp8.0
new file mode 100644
index 000000000..28f00cde0
--- /dev/null
+++ b/bin/sh/tests/errors/bad-parm-exp8.0
@@ -0,0 +1,4 @@
+# $FreeBSD$
+
+v=1
+eval ": $(printf '${v-${w\372}}')"
-- 
2.42.0