[Toybox] find crash

[Isaac Dunham]

On Wed, Sep 09, 2015 at 07:59:41PM -0700, enh wrote:
> mentioned on https://android-review.googlesource.com/#/c/170020/:
> 
> touch file1
> touch file2
> touch file2
> ./toybox find . -mindepth 1 -newer file1 -exec ls {} ;
> 
> Program terminated with signal SIGSEGV, Segmentation fault.
> #0  do_find (new=0x133a190) at toys/posix/find.c:179
> 179            if (dl->prev == (void *)1 || !new->parent)
> 
> 
> the "-mindepth 1" appears to be a necessary condition.
> 

I can duplicate (Alpine Linux edge, musl/gcc 5.2) only if ';' is not
properly quoted.

Basically, it seems that -mindepth is screwing up -exec:
if both are passed, the '{}' for -exec is reported as a bad arg.

If the ending for exec (+ or ;) is missing, you get a segfault.

By the way, I suspect that "-mindepth 1' is actually a bad substitute
for '! -type d'.

> (really they wanted to use '+' but found that wasn't working, and hit
> this crash when investigating.)

And this I can duplicate, regardless whether -newer or -mindepth are passed;
if you use '+', no *exec*() is ever called.


HTH,
Isaac Dunham

 1441856313.0