[PATCH] check empty callback in mapfile

[isabella parakiss]

In builtins/mapfile.def there's this line:
snprintf (execstr, execlen, "%s %d %s", callback, curindex, qline);

If the callback is empty, bash runs '<space><number><space><line>'
This smells a lot like code injection.

$ echo 'echo hello from $0' > ~/bin/0
$ chmod +x ~/bin/0
$ cp ~/bin/{0,1}
$ echo -e 'x\ny' | mapfile -c1 -C ''
hello from /home/izabera/0
hello from /home/izabera/1

^^^ That's not at all the result I expected.



This is a simple patch:

 builtins/mapfile.def | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/builtins/mapfile.def b/builtins/mapfile.def
index 03f0b48..f91e432 100644
--- a/builtins/mapfile.def
+++ b/builtins/mapfile.def
@@ -178,6 +178,11 @@ mapfile (fd, line_count_goal, origin, nskip,
callback_quantum, callback, array_n
       builtin_error (_("%s: not an indexed array"), array_name);
       return (EXECUTION_FAILURE);
     }
+  else if (callback && *callback == 0)
+    {
+      builtin_error (_("%s: empty callback"));
+      return (EXECUTION_FAILURE);
+    }
   else if (invisible_p (entry))
     VUNSETATTR (entry, att_invisible); /* no longer invisible */



---
xoxo iza