On Sep 4, 11:25am, mickey@lucifier.remote.dti.net (Michael Shalayeff) wrote:
-- Subject: Re: csh bug

| > can you please send also an example that exercises the bug?
| oh, sorry.
| 
| env PATH='/a/*/d/b/g' csh

Hmm, I looked at the code path, and this should really not be expanding.
It seems like only 1/2 of the bug fix made it from tcsh to csh. I.e. You
really don't want someone feeding you:

	env PATH='`rm -fr /`' /bin/csh

and expanding environment variables. In addition there is no way to handle
paths that contain globbing characters. The fix follows [plus two small memory
leaks]... I should go through the tcsh code and make sure that the important
fixes have made it into the csh base.

Releng, I am submitting this as a pullup for 1.5...

Please pull up 1.25 -> 1.26 for /cvsroot/basesrc/bin/csh/csh.c

Thanks for finding this,

christos

Index: csh.c
===================================================================
RCS file: /cvsroot/basesrc/bin/csh/csh.c,v
retrieving revision 1.25
diff -u -u -r1.25 csh.c
--- csh.c	2000/05/31 22:48:44	1.25
+++ csh.c	2000/09/04 17:46:17
@@ -261,12 +261,12 @@
      */
     if ((ecp = getenv("PATH")) == NULL) {
 #ifdef _PATH_DEFPATH
-	importpath(SAVE(_PATH_DEFPATH));
+	importpath(str2short(_PATH_DEFPATH));
 #else
 	setq(STRpath, defaultpath(), &shvhed);
 #endif
     } else {
-	importpath(SAVE(ecp));
+	importpath(str2short(ecp));
     }
 
     set(STRshell, Strsave(STR_SHELLPATH));
@@ -647,7 +647,7 @@
 	    dp++;
 	}
     pv[i] = 0;
-    set1(STRpath, pv, &shvhed);
+    setq(STRpath, pv, &shvhed);
 }
 
 /*