[patch] Fix for BZ 18042 buffer-overflow (read past the end) in wordexp/parse_backtick/parse_backslash

[Paul Pluzhnikov]

Greetings,

parse_backslash() expects to be looking *at* backslash, not past it.


2015-02-27  Paul Pluzhnikov  <ppluzhnikov@google.com>

        [BZ #18042]
        * posix/wordexp.c (parse_backtick): Fix off-by-one.
        * posix/wordexp-test.c: Add test.

-- 
Paul Pluzhnikov
-------------- next part --------------
diff --git a/posix/wordexp-test.c b/posix/wordexp-test.c
index 8a312e0..0647044 100644
--- a/posix/wordexp-test.c
+++ b/posix/wordexp-test.c
@@ -232,6 +232,9 @@ struct test_case_struct
     { WRDE_CMDSUB, NULL, "$((1+`echo 1`))", WRDE_NOCMD, 0, { NULL, }, IFS },
     { WRDE_CMDSUB, NULL, "$((1+$((`echo 1`))))", WRDE_NOCMD, 0, { NULL, }, IFS },
 
+    /* BZ 18042 */
+    { WRDE_SYNTAX, NULL, "`\\", 0, 0, { NULL, }, IFS },
+
     { -1, NULL, NULL, 0, 0, { NULL, }, IFS },
   };
 
diff --git a/posix/wordexp.c b/posix/wordexp.c
index e3d8d6b..e75b92e 100644
--- a/posix/wordexp.c
+++ b/posix/wordexp.c
@@ -2143,7 +2143,6 @@ parse_backtick (char **word, size_t *word_length, size_t *max_length,
 	      break;
 	    }
 
-	  ++(*offset);
 	  error = parse_backslash (&comm, &comm_length, &comm_maxlen, words,
 				   offset);