[PATCH][BZ #18096] Handle null dereferences in wordexp

["Ondřej Bílka" <neleai@seznam.cz>]

Hi,

Kostya, and Carlos wrote this patch on bugzilla but I didn't seen it on
libc-alpha.

These look good for me. Carlos, could you commit it?


diff --git a/posix/wordexp.c b/posix/wordexp.c
index e711d43..d3f3764 100644
--- a/posix/wordexp.c
+++ b/posix/wordexp.c
@@ -740,7 +740,7 @@ parse_arith (char **word, size_t *word_length, size_t *max_length,
 	      ++(*offset);
 
 	      /* Go - evaluate. */
-	      if (*expr && eval_expr (expr, &numresult) != 0)
+	      if (expr && *expr && eval_expr (expr, &numresult) != 0)
 		{
 		  free (expr);
 		  return WRDE_SYNTAX;
@@ -778,7 +778,7 @@ parse_arith (char **word, size_t *word_length, size_t *max_length,
 	      long int numresult = 0;
 
 	      /* Go - evaluate. */
-	      if (*expr && eval_expr (expr, &numresult) != 0)
+	      if (expr && *expr && eval_expr (expr, &numresult) != 0)
 		{
 		  free (expr);
 		  return WRDE_SYNTAX;
@@ -1843,11 +1843,11 @@ envsubst:
 	  if (!colon_seen && value)
 	    /* Substitute NULL */
 	    ;
-	  else
+	  else if (flags & WRDE_SHOWERR)
 	    {
 	      const char *str = pattern;
 
-	      if (str[0] == '\0')
+	      if (str && str[0] == '\0')
 		str = _("parameter null or not set");
 
 	      __fxprintf (NULL, "%s: %s\n", env, str);