setexpr: Correct buffer overflow bug and enable tests

At present when more than one substitution is made this function
overwrites its buffers. Fix this bug and update the tests now that they
can pass.

Also update the debug code to show all substrings, since at present it
omits the final one.

Fixes: 855f18ea0e6 ("setexpr: add regex substring matching and substitution")
Signed-off-by: Simon Glass <sjg@chromium.org>

diff --git a/cmd/setexpr.c b/cmd/setexpr.c
index 0cc7cf15bd7daddfb2c1fede854acb23c5e85ffc..d364dbc2bc536a474a2b60bf172c9460b2cdeacc 100644 (file)
--- a/cmd/setexpr.c
+++ b/cmd/setexpr.c
@@ -155,11 +155,11 @@ int setexpr_regex_sub(char *data, uint data_size, char *nbuf, uint nbuf_size,
 
                (void) memset(caps, 0, sizeof(caps));
 
-               res = slre_match(&slre, datap, len, caps);
+               res = slre_match(&slre, datap, len - (datap - data), caps);
 
                debug("Result: %d\n", res);
 
-               for (i = 0; i < slre.num_caps; i++) {
+               for (i = 0; i <= slre.num_caps; i++) {
                        if (caps[i].len > 0) {
                                debug("Substring %d: [%.*s]\n", i,
                                        caps[i].len, caps[i].ptr);
@@ -231,7 +231,7 @@ int setexpr_regex_sub(char *data, uint data_size, char *nbuf, uint nbuf_size,
                                        break;
 
                                np = substitute(np, &nlen,
-                                       nbuf_size,
+                                       nbuf_size - (np - nbuf),
                                        backref, 2,
                                        caps[i].ptr, caps[i].len);
 
@@ -241,8 +241,8 @@ int setexpr_regex_sub(char *data, uint data_size, char *nbuf, uint nbuf_size,
                }
                debug("## SUBST(2) ## %s\n", nbuf);
 
-               datap = substitute(datap, &len, data_size, old, olen,
-                                  nbuf, nlen);
+               datap = substitute(datap, &len, data_size - (datap - data),
+                                  old, olen, nbuf, nlen);
 
                if (datap == NULL)
                        return 1;

diff --git a/test/cmd/setexpr.c b/test/cmd/setexpr.c
index d06dda260e65a1052b45a81c865456dd22ea6569..2a897efd9bd6c97126b5dbbee243def0ffd6a30e 100644 (file)
--- a/test/cmd/setexpr.c
+++ b/test/cmd/setexpr.c
@@ -166,12 +166,10 @@ static int setexpr_test_regex(struct unit_test_state *uts)
 
        /* Global substitution */
        ut_assertok(run_command("setenv fred 'this is a test'", 0));
-       if (0) {
-               /* Causes a crash at present due to a bug in setexpr */
-               ut_assertok(run_command("setexpr fred gsub is us", 0));
-               val = env_get("fred");
-               ut_asserteq_str("thus us a test", val);
-       }
+       ut_assertok(run_command("setexpr fred gsub is us", 0));
+       val = env_get("fred");
+       ut_asserteq_str("thus us a test", val);
+
        /* Global substitution */
        ut_assertok(run_command("setenv fred 'this is a test'", 0));
        ut_assertok(run_command("setenv mary 'this is a test'", 0));
@@ -195,14 +193,9 @@ static int setexpr_test_regex_inc(struct unit_test_state *uts)
        buf = map_sysmem(0, BUF_SIZE);
 
        ut_assertok(run_command("setenv fred 'this is a test'", 0));
-       if (0) {
-               /* Causes a crash at present due to a bug in setexpr */
-               ut_assertok(run_command("setexpr fred gsub is much_longer_string",
-                                       0));
-               val = env_get("fred");
-               ut_asserteq_str("thmuch_longer_string much_longer_string a test",
-                               val);
-       }
+       ut_assertok(run_command("setexpr fred gsub is much_longer_string", 0));
+       val = env_get("fred");
+       ut_asserteq_str("thmuch_longer_string much_longer_string a test", val);
        unmap_sysmem(buf);
 
        return 0;
@@ -234,9 +227,6 @@ static int setexpr_test_sub(struct unit_test_state *uts)
        ut_assertok(setexpr_regex_sub(buf, BUF_SIZE, nbuf, BUF_SIZE, "is",
                                      "us it is longer", true));
        ut_asserteq_str("thus it is longer us it is longer a test", buf);
-
-       /* The following checks fail at present due to a bug in setexpr */
-       return 0;
        for (i = BUF_SIZE; i < 0x1000; i++) {
                ut_assertf(buf[i] == (char)i,
                           "buf byte at %x should be %02x, got %02x)\n",