ash: fix unsafe use of mempcpy

function                                             old     new   delta
subevalvar                                          1549    1557      +8

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

1 files changed, 7 insertions, 1 deletions

diff --git a/shell/ash.c b/shell/ash.c
index 54335c5dd..44ec2eafd 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -7191,7 +7191,13 @@ subevalvar(char *start, char *str, int strloc,
 			len = orig_len - pos;
 
 		if (!quotes) {
-			loc = mempcpy(startp, startp + pos, len);
+			/* want: loc = mempcpy(startp, startp + pos, len)
+			 * but it does not allow overlapping arguments */
+			loc = startp;
+			while (--len >= 0) {
+				*loc = loc[pos];
+				loc++;
+			}
 		} else {
 			for (vstr = startp; pos != 0; pos--) {
 				if ((unsigned char)*vstr == CTLESC)