Changeset 3133 in kBuild for trunk/src/kmk/kmkbuiltin/common-env-and-cwd-opt.c

Timestamp:

Feb 23, 2018 9:33:27 PM (7 years ago)

Author:

bird

Message:

kBuiltinOptEnvAppendPrepend: Fixed heap corruption found by Vitali. Cleaned up confused code around it.

File:

• trunk/src/kmk/kmkbuiltin/common-env-and-cwd-opt.c (modified) (1 diff)

trunk/src/kmk/kmkbuiltin/common-env-and-cwd-opt.c

@@ -186 +186 @@
                 && pszCur[cchVar] == '=')
             {
-                size_t cchOldValue = strlen(papszEnv[iEnvVar]) - cchVar - 1;
-                size_t cchNewValue = strlen(pszValue)          - cchVar - 1;
-                char *pszNew = malloc(cchVar + 1 + cchOldValue + cchNewValue);
-                if (!papszEnv[iEnvVar])
+                size_t cchOldValue = strlen(pszCur)   - cchVar - 1;
+                size_t cchNewValue = strlen(pszValue) - cchVar - 1;
+                char  *pszNew      = malloc(cchVar + 1 + cchOldValue + cchNewValue + 1);
+                if (!pszNew)
                     return errx(1, "out of memory!");
                 if (fAppend)
                 {
-                    memcpy(pszNew, papszEnv[iEnvVar], cchVar + 1 + cchOldValue);
+                    memcpy(pszNew, pszCur, cchVar + 1 + cchOldValue);
                     memcpy(&pszNew[cchVar + 1 + cchOldValue], &pszValue[cchVar + 1], cchNewValue + 1);
                 }
                 else
                 {
-                    memcpy(pszNew, papszEnv[iEnvVar], cchVar + 1); /* preserve variable name case  */
+                    memcpy(pszNew, pszCur, cchVar + 1); /* preserve variable name case  */
                     memcpy(&pszNew[cchVar + 1], &pszValue[cchVar + 1], cchNewValue);
-                    memcpy(&pszNew[cchVar + 1 + cchNewValue], &papszEnv[iEnvVar][cchVar + 1], cchOldValue + 1);
+                    memcpy(&pszNew[cchVar + 1 + cchNewValue], &pszCur[cchVar + 1], cchOldValue + 1);
                 }
 
                 if (cVerbosity > 0)
-                    warnx("replacing '%s' with '%s'", papszEnv[iEnvVar], pszNew);
-                free(papszEnv[iEnvVar]);
+                    warnx("replacing '%s' with '%s'", pszCur, pszNew);
+                free(pszCur);
                 papszEnv[iEnvVar] = pszNew;