I found and fixed yet another use after free bug in pdksh. This bug is likely about 30 years old or so.
- c_eval (shell "eval" command) creates a new "strict source" "s" from current env ATEMP: https://github.com/Orc/pdksh/blob/131021a130337e3313195c9d321c6aa40b4e291d/c_sh.c#L429
- c_eval passes the created source to "shell" function:
https://github.com/Orc/pdksh/blob/131021a130337e3313195c9d321c6aa40b4e291d/c_sh.c#L459
- "shell" calls "compile" function: https://github.com/Orc/pdksh/blob/131021a130337e3313195c9d321c6aa40b4e291d/main.c#L593
- "compile" function assigns the global "source" pointer to the passed source: https://github.com/Orc/pdksh/blob/131021a130337e3313195c9d321c6aa40b4e291d/syn.c#L790
At some point (I didn't bother tracing exactly where and in what circumstances - certain parts of gmp-6.3.0 configure script trigger it, at least on our platform) the ATEMP associated with the "env" gets released via call to "reclaim", but the "source" pointer will continue to point to the already released memory. This leads to classic Use After Free condition and all kinds of havoc and eventually a crash.
The fix is easy enough: Save and restore the original source pointer in c_eval:
--- pdksh-5.2.14/c_sh.c 1999-07-13 19:54:44.000000000 +0300
+++ pdksh-5.2.14-fixed/c_sh.c 2025-05-20 23:08:41.162128448 +0300
@@ -423,6 +423,8 @@
char **wp;
{
register struct source *s;
+ struct source *sold;
+ int ret;
if (ksh_getopt(wp, &builtin_opt, null) == '?')
return 1;
@@ -456,7 +458,10 @@
exstat = subst_exstat;
}
- return shell(s, FALSE);
+ sold = source;
+ ret = shell(s, FALSE);
+ source = sold;
+ return ret;
}
int
'/%3e%3cpath%20d='M50.3943%2022.237V39.5876H43.5185V22.7481C43.5185%2019.2029%2042.0411%2017.3949%2039.036%2017.3949C35.7325%2017.3949%2034.0778%2019.5338%2034.0778%2023.7585V32.9759H27.2434V23.7585C27.2434%2019.5338%2025.5857%2017.3949%2022.2822%2017.3949C19.2949%2017.3949%2017.8027%2019.2029%2017.8027%2022.7481V39.5876H10.9298V22.237C10.9298%2018.6918%2011.835%2015.8754%2013.6453%2013.7877C15.5128%2011.7049%2017.9623%2010.6355%2021.0028%2010.6355C24.522%2010.6355%2027.1813%2011.9885%2028.9542%2014.6917L30.665%2017.5633L32.3788%2014.6917C34.1517%2011.9885%2036.811%2010.6355%2040.3243%2010.6355C43.3619%2010.6355%2045.8114%2011.7049%2047.6847%2013.7877C49.4931%2015.8734%2050.3963%2018.6899%2050.3943%2022.237Z'%20fill='white'/%3e%3cdefs%3e%3clinearGradient%20id='paint0_linear_89_8'%20x1='30.5'%20y1='0'%20x2='30.5'%20y2='65'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%236364FF'/%3e%3cstop%20offset='1'%20stop-color='%23563ACC'/%3e%3c/linearGradient%3e%3c/defs%3e%3c/svg%3e)
