diff options
| author | Otto Moerbeek <otto@cvs.openbsd.org> | 2006-03-20 20:54:09 +0000 |
|---|---|---|
| committer | Otto Moerbeek <otto@cvs.openbsd.org> | 2006-03-20 20:54:09 +0000 |
| commit | a8a78eb3cd207118c80c748c1938ddde1a68b819 (patch) | |
| tree | 3e1592126495fdca56c0b688f796d58b746af1f9 /bin/ksh/syn.c | |
| parent | 59c4ef87b769c1a36b20f45eab3060bb9dbc0d22 (diff) | |
Fix potential null deref and out-of-bound access.
ok millert@ deraadt@
Diffstat (limited to 'bin/ksh/syn.c')
| -rw-r--r-- | bin/ksh/syn.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/bin/ksh/syn.c b/bin/ksh/syn.c index 525a5bebf2a..d180ff07f6f 100644 --- a/bin/ksh/syn.c +++ b/bin/ksh/syn.c @@ -1,4 +1,4 @@ -/* $OpenBSD: syn.c,v 1.24 2006/03/14 22:08:40 deraadt Exp $ */ +/* $OpenBSD: syn.c,v 1.25 2006/03/20 20:54:08 otto Exp $ */ /* * shell parser (C version) @@ -851,7 +851,8 @@ dbtestp_isa(Test_env *te, Test_meta meta) ret = uqword && strcmp(yylval.cp, db_close) == 0; if (ret) { ACCEPT; - if (meta != TM_END) { + if (meta != TM_END && meta >= 0 && + meta < sizeof(dbtest_tokens) / sizeof(dbtest_tokens[0])) { if (!save) save = wdcopy(dbtest_tokens[(int) meta], ATEMP); XPput(*te->pos.av, save); |