1From fe0586347ee46f927ae27bb9673532da9f5dead5 Mon Sep 17 00:00:00 2001
2From: Daniel Axtens <dja@axtens.net>
3Date: Mon, 11 Jan 2021 17:30:42 +1100
4Subject: [PATCH] script/execute: Avoid crash when using "$#" outside a
5 function scope
6
7"$#" represents the number of arguments to a function. It is only
8defined in a function scope, where "scope" is non-NULL. Currently,
9if we attempt to evaluate "$#" outside a function scope, "scope" will
10be NULL and we will crash with a NULL pointer dereference.
11
12Do not attempt to count arguments for "$#" if "scope" is NULL. This
13will result in "$#" being interpreted as an empty string if evaluated
14outside a function scope.
15
16Signed-off-by: Daniel Axtens <dja@axtens.net>
17Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
18Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
19---
20 grub-core/script/execute.c | 2 +-
21 1 file changed, 1 insertion(+), 1 deletion(-)
22
23diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c
24index 5ea2aef..23d34bd 100644
25--- a/grub-core/script/execute.c
26+++ b/grub-core/script/execute.c
27@@ -485,7 +485,7 @@ gettext_putvar (const char *str, grub_size_t len,
28     return 0;
29
30   /* Enough for any number.  */
31-  if (len == 1 && str[0] == '#')
32+  if (len == 1 && str[0] == '#' && scope != NULL)
33     {
34       grub_snprintf (*ptr, 30, "%u", scope->argv.argc);
35       *ptr += grub_strlen (*ptr);
36--
372.14.2
38
39