Hi,

sorry for taking so long. Do you have a small testcase showing the bug?

best regards Waldemar

Am 18.08.2018 um 19:21 schrieb Segev Finer segev208@gmail.com:

The original from glibc received the end of the buffer and worked backwards. Ours needs the beginning of the buffer.

Signed-off-by: Segev Finer segev208@gmail.com

libc/misc/wordexp/wordexp.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/libc/misc/wordexp/wordexp.c b/libc/misc/wordexp/wordexp.c index fb635fe91..285e81e87 100644 --- a/libc/misc/wordexp/wordexp.c +++ b/libc/misc/wordexp/wordexp.c @@ -491,10 +491,10 @@ parse_squote(char **word, size_t * word_length, size_t * max_length, #ifdef __WORDEXP_FULL static int eval_expr(char *expr, long int *result);

-static char *_itoa(unsigned long long int value, char *buflim) +static char *_itoa(unsigned long long int value, char *buf) {

• sprintf(buflim, "%llu", value);
• return buflim;

• sprintf(buf, "%llu", value);
• return buf;

}

/* Functions to evaluate an arithmetic expression */ @@ -692,7 +692,7 @@ parse_arith(char **word, size_t * word_length, size_t * max_length,

           result[20] = '\0';
           *word = w_addstr(*word, word_length, max_length,

•                             _itoa(convertme, &result[20]));
  

•                             _itoa(convertme, result));
           free(expr);
           return *word ? 0 : WRDE_NOSPACE;
       }
  

@@ -717,7 +717,7 @@ parse_arith(char **word, size_t * word_length, size_t * max_length,

           result[20] = '\0';
           *word = w_addstr(*word, word_length, max_length,

•                             _itoa(numresult, &result[20]));
  

•                             _itoa(numresult, result));
           free(expr);
           return *word ? 0 : WRDE_NOSPACE;
       }
  

@@ -1313,7 +1313,7 @@ parse_param(char **word, size_t * word_length, size_t * max_length, if (seen_hash) { /* $# expands to the number of positional parameters */ buffer[20] = '\0';

•        value = _itoa(__libc_argc - 1, &buffer[20]);
  

•        value = _itoa(__libc_argc - 1, buffer);
       seen_hash = 0;
   } else {
       /* Just $ on its own */
  

@@ -1338,13 +1338,13 @@ parse_param(char **word, size_t * word_length, size_t * max_length, /* Is it `$$'? */ if (*env == '$') { buffer[20] = '\0';

•        value = _itoa(getpid(), &buffer[20]);
  

•        value = _itoa(getpid(), buffer);
   }
   /* Is it `${#*}' or `${#@}'? */
   else if ((*env == '*' || *env == '@') && seen_hash) {
       buffer[20] = '\0';
       value = _itoa(__libc_argc > 0 ? __libc_argc - 1 : 0,
  

•                           &buffer[20]);
  

•                           buffer);
       *word = w_addstr(*word, word_length, max_length, value);
       free(env);
       free(pattern);
  

@@ -1770,7 +1770,7 @@ parse_param(char **word, size_t * word_length, size_t * max_length, param_length[20] = '\0'; *word = w_addstr(*word, word_length, max_length, _itoa(value ? strlen(value) : 0,

•                                &param_length[20]));
  

•                                param_length));
   if (free_value) {
       assert(value != NULL);
       free(value);
  

-- 2.18.0

---

devel mailing list devel@uclibc-ng.org https://mailman.uclibc-ng.org/cgi-bin/mailman/listinfo/devel