Mirrors/u-boot
2
0
Fork 0
mirror of https://github.com/AsahiLinux/u-boot synced 2024-11-24 21:54:01 +00:00
Code Issues Projects Releases Packages Wiki Activity

setexpr: Correct buffer overflow bug and enable tests

Browse source 
At present when more than one substitution is made this function
overwrites its buffers. Fix this bug and update the tests now that they
can pass.

Also update the debug code to show all substrings, since at present it
omits the final one.

Fixes: 855f18ea0e ("setexpr: add regex substring matching and substitution")
Signed-off-by: Simon Glass <sjg@chromium.org>
This commit is contained in:
Simon Glass 2020-11-01 14:15:42 -07:00 committed by Tom Rini
parent 9528229f22
commit 8f4aa7ddb9
2 changed files with 12 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
cmd/setexpr.c
View file

@ -155,11 +155,11 @@ int setexpr_regex_sub(char *data, uint data_size, char *nbuf, uint nbuf_size,
(void) memset(caps, 0, sizeof(caps));
res = slre_match(&slre, datap, len, caps);
res = slre_match(&slre, datap, len - (datap - data), caps);
debug("Result: %d\n", res);
for (i = 0; i < slre.num_caps; i++) {
for (i = 0; i <= slre.num_caps; i++) {
if (caps[i].len > 0) {
debug("Substring %d: [%.*s]\n", i,
caps[i].len, caps[i].ptr);
@ -231,7 +231,7 @@ int setexpr_regex_sub(char *data, uint data_size, char *nbuf, uint nbuf_size,
break;
np = substitute(np, &nlen,
nbuf_size,
nbuf_size - (np - nbuf),
backref, 2,
caps[i].ptr, caps[i].len);
@ -241,8 +241,8 @@ int setexpr_regex_sub(char *data, uint data_size, char *nbuf, uint nbuf_size,
}
debug("## SUBST(2) ## %s\n", nbuf);
datap = substitute(datap, &len, data_size, old, olen,
nbuf, nlen);
datap = substitute(datap, &len, data_size - (datap - data),
old, olen, nbuf, nlen);
if (datap == NULL)
return 1;

24
test/cmd/setexpr.c
View file

@ -166,12 +166,10 @@ static int setexpr_test_regex(struct unit_test_state *uts)
/* Global substitution */
ut_assertok(run_command("setenv fred 'this is a test'", 0));
if (0) {
/* Causes a crash at present due to a bug in setexpr */
ut_assertok(run_command("setexpr fred gsub is us", 0));
val = env_get("fred");
ut_asserteq_str("thus us a test", val);
}
ut_assertok(run_command("setexpr fred gsub is us", 0));
val = env_get("fred");
ut_asserteq_str("thus us a test", val);
/* Global substitution */
ut_assertok(run_command("setenv fred 'this is a test'", 0));
ut_assertok(run_command("setenv mary 'this is a test'", 0));
@ -195,14 +193,9 @@ static int setexpr_test_regex_inc(struct unit_test_state *uts)
buf = map_sysmem(0, BUF_SIZE);
ut_assertok(run_command("setenv fred 'this is a test'", 0));
if (0) {
/* Causes a crash at present due to a bug in setexpr */
ut_assertok(run_command("setexpr fred gsub is much_longer_string",
0));
val = env_get("fred");
ut_asserteq_str("thmuch_longer_string much_longer_string a test",
val);
}
ut_assertok(run_command("setexpr fred gsub is much_longer_string", 0));
val = env_get("fred");
ut_asserteq_str("thmuch_longer_string much_longer_string a test", val);
unmap_sysmem(buf);
return 0;
@ -234,9 +227,6 @@ static int setexpr_test_sub(struct unit_test_state *uts)
ut_assertok(setexpr_regex_sub(buf, BUF_SIZE, nbuf, BUF_SIZE, "is",
"us it is longer", true));
ut_asserteq_str("thus it is longer us it is longer a test", buf);
/* The following checks fail at present due to a bug in setexpr */
return 0;
for (i = BUF_SIZE; i < 0x1000; i++) {
ut_assertf(buf[i] == (char)i,
"buf byte at %x should be %02x, got %02x)\n",