1*4882a593SmuzhiyunFrom fe0586347ee46f927ae27bb9673532da9f5dead5 Mon Sep 17 00:00:00 2001
2*4882a593SmuzhiyunFrom: Daniel Axtens <dja@axtens.net>
3*4882a593SmuzhiyunDate: Mon, 11 Jan 2021 17:30:42 +1100
4*4882a593SmuzhiyunSubject: [PATCH] script/execute: Avoid crash when using "$#" outside a
5*4882a593Smuzhiyun function scope
6*4882a593Smuzhiyun
7*4882a593Smuzhiyun"$#" represents the number of arguments to a function. It is only
8*4882a593Smuzhiyundefined in a function scope, where "scope" is non-NULL. Currently,
9*4882a593Smuzhiyunif we attempt to evaluate "$#" outside a function scope, "scope" will
10*4882a593Smuzhiyunbe NULL and we will crash with a NULL pointer dereference.
11*4882a593Smuzhiyun
12*4882a593SmuzhiyunDo not attempt to count arguments for "$#" if "scope" is NULL. This
13*4882a593Smuzhiyunwill result in "$#" being interpreted as an empty string if evaluated
14*4882a593Smuzhiyunoutside a function scope.
15*4882a593Smuzhiyun
16*4882a593SmuzhiyunSigned-off-by: Daniel Axtens <dja@axtens.net>
17*4882a593SmuzhiyunReviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
18*4882a593SmuzhiyunSigned-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
19*4882a593Smuzhiyun---
20*4882a593Smuzhiyun grub-core/script/execute.c | 2 +-
21*4882a593Smuzhiyun 1 file changed, 1 insertion(+), 1 deletion(-)
22*4882a593Smuzhiyun
23*4882a593Smuzhiyundiff --git a/grub-core/script/execute.c b/grub-core/script/execute.c
24*4882a593Smuzhiyunindex 5ea2aef..23d34bd 100644
25*4882a593Smuzhiyun--- a/grub-core/script/execute.c
26*4882a593Smuzhiyun+++ b/grub-core/script/execute.c
27*4882a593Smuzhiyun@@ -485,7 +485,7 @@ gettext_putvar (const char *str, grub_size_t len,
28*4882a593Smuzhiyun     return 0;
29*4882a593Smuzhiyun
30*4882a593Smuzhiyun   /* Enough for any number.  */
31*4882a593Smuzhiyun-  if (len == 1 && str[0] == '#')
32*4882a593Smuzhiyun+  if (len == 1 && str[0] == '#' && scope != NULL)
33*4882a593Smuzhiyun     {
34*4882a593Smuzhiyun       grub_snprintf (*ptr, 30, "%u", scope->argv.argc);
35*4882a593Smuzhiyun       *ptr += grub_strlen (*ptr);
36*4882a593Smuzhiyun--
37*4882a593Smuzhiyun2.14.2
38*4882a593Smuzhiyun
39