|
 |
42f817 |
diff --git a/src/cmd/ksh93/sh/arith.c b/src/cmd/ksh93/sh/arith.c
|
|
|
42f817 |
--- a/src/cmd/ksh93/sh/arith.c
|
|
|
42f817 |
+++ b/src/cmd/ksh93/sh/arith.c
|
|
|
42f817 |
@@ -513,21 +513,34 @@ Sfdouble_t sh_strnum(register const char *str, char** ptr, int mode)
|
|
|
42f817 |
char base=(shp->inarith?0:10), *last;
|
|
|
42f817 |
if(*str==0)
|
|
|
42f817 |
{
|
|
|
42f817 |
- if(ptr)
|
|
|
42f817 |
- *ptr = (char*)str;
|
|
|
42f817 |
- return(0);
|
|
|
42f817 |
- }
|
|
|
42f817 |
- errno = 0;
|
|
|
42f817 |
- d = strtonll(str,&last,&base,-1);
|
|
|
42f817 |
- if(*last || errno)
|
|
|
42f817 |
- {
|
|
|
42f817 |
- if(!last || *last!='.' || last[1]!='.')
|
|
|
42f817 |
- d = strval(shp,str,&last,arith,mode);
|
|
|
42f817 |
- if(!ptr && *last && mode>0)
|
|
|
42f817 |
- errormsg(SH_DICT,ERROR_exit(1),e_lexbadchar,*last,str);
|
|
|
42f817 |
+ d = 0.0;
|
|
|
42f817 |
+ last = (char*)str;
|
|
|
42f817 |
+ } else {
|
|
|
42f817 |
+ errno = 0;
|
|
|
42f817 |
+ d = strtonll(str,&last,&base,-1);
|
|
|
42f817 |
+ if (*last && !shp->inarith && sh_isstate(SH_INIT)) {
|
|
|
42f817 |
+ // This call is to handle "base#value" literals if we're importing untrusted env vars.
|
|
|
42f817 |
+ errno = 0;
|
|
|
42f817 |
+ d = strtonll(str, &last, NULL, -1);
|
|
|
42f817 |
+ }
|
|
|
42f817 |
+
|
|
|
42f817 |
+ if(*last || errno)
|
|
|
42f817 |
+ {
|
|
|
42f817 |
+ if (sh_isstate(SH_INIT)) {
|
|
|
42f817 |
+ // Initializing means importing untrusted env vars. Since the string does not appear
|
|
|
42f817 |
+ // to be a recognized numeric literal give up. We can't safely call strval() since
|
|
|
42f817 |
+ // that allows arbitrary expressions which would create a security vulnerability.
|
|
|
42f817 |
+ d = 0.0;
|
|
|
42f817 |
+ } else {
|
|
|
42f817 |
+ if(!last || *last!='.' || last[1]!='.')
|
|
|
42f817 |
+ d = strval(shp,str,&last,arith,mode);
|
|
|
42f817 |
+ if(!ptr && *last && mode>0)
|
|
|
42f817 |
+ errormsg(SH_DICT,ERROR_exit(1),e_lexbadchar,*last,str);
|
|
|
42f817 |
+ }
|
|
|
42f817 |
+ } else if (!d && *str=='-') {
|
|
|
42f817 |
+ d = -0.0;
|
|
|
42f817 |
+ }
|
|
|
42f817 |
}
|
|
|
42f817 |
- else if (!d && *str=='-')
|
|
|
42f817 |
- d = -0.0;
|
|
|
42f817 |
if(ptr)
|
|
|
42f817 |
*ptr = last;
|
|
|
42f817 |
return(d);
|