From matt@zigg.com Sun Jun  6 10:49:01 1999
Return-Path: <matt@zigg.com>
Received: from megaweapon.zigg.com (megaweapon.zigg.com [206.114.60.8])
	by hub.freebsd.org (Postfix) with ESMTP id 817271548A
	for <FreeBSD-gnats-submit@freebsd.org>; Sun,  6 Jun 1999 10:48:58 -0700 (PDT)
	(envelope-from matt@zigg.com)
Received: from torgo.zigg.local (torgo.zigg.local [192.168.1.18])
	by megaweapon.zigg.com (8.9.3/8.9.3) with ESMTP id NAA28448
	for <FreeBSD-gnats-submit@freebsd.org>; Sun, 6 Jun 1999 13:48:57 -0400 (EDT)
	(envelope-from matt@torgo.zigg.local)
Received: (from matt@localhost)
	by torgo.zigg.local (8.9.3/8.9.3) id NAA00284;
	Sun, 6 Jun 1999 13:48:55 -0400 (EDT)
	(envelope-from matt)
Message-Id: <199906061748.NAA00284@torgo.zigg.local>
Date: Sun, 6 Jun 1999 13:48:55 -0400 (EDT)
From: matt@zigg.com
Reply-To: matt@zigg.com
To: FreeBSD-gnats-submit@freebsd.org
Subject: sh type builtin appends first path component to absolute result
X-Send-Pr-Version: 3.2

>Number:         12052
>Category:       bin
>Synopsis:       sh type builtin appends first path component to absolute result
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    cracauer
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Jun  6 10:50:01 PDT 1999
>Closed-Date:    Sat May 26 16:21:00 PDT 2001
>Last-Modified:  Sat May 26 16:21:13 PDT 2001
>Originator:     Matt Behrens
>Release:        FreeBSD 3.2-19990531-STABLE i386
>Organization:
zigg.com
>Environment:

FreeBSD torgo.zigg.local 3.2-19990531-STABLE FreeBSD 3.2-19990531-STABLE #0: Fri Jun  4 09:08:13 EDT 1999     matt@torgo.zigg.local:/usr/src/sys/compile/TORGO  i386

>Description:

When using sh's `type' builtin on a file with an absolute path,
the file is reported found with the user's first PATH component
and a slash prepended.

(Admittedly, it may be silly to use `type' on a file with an absolute
path.)

>How-To-Repeat:

$ export PATH=/whatever
$ type /COPYRIGHT
COPYRIGHT is /whatever//COPYRIGHT

>Fix:

Unknown.  Still learning C.  :-(

>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->analyzed 
State-Changed-By: des 
State-Changed-When: Mon Jun 7 10:28:54 PDT 1999 
State-Changed-Why:  
Problem analyzed, no patch yet. 

From: Dag-Erling Smorgrav <des@flood.ping.uio.no>
To: matt@zigg.com
Cc: FreeBSD-gnats-submit@FreeBSD.ORG
Subject: Re: bin/12052: sh type builtin appends first path component to absolute result
Date: 07 Jun 1999 19:28:36 +0200

 matt@zigg.com writes:
 > >Fix:
 
 No fix yet, but an analysis: since the argument to 'type' (typecmd()
 in src/bin/sh/exec.c) is neither a builtin nor an alias, typecmd()
 calls find_command() (also in src/bin/sh/exec.c). The first thing
 find_command() does is check if the command contains a slash, in which
 case it sets the command type to CMDNORMAL and the path index to 0:
 
 	/* If name contains a slash, don't use the hash table */
 	if (strchr(name, '/') != NULL) {
 		entry->cmdtype = CMDNORMAL;
 		entry->u.index = 0;
 		return;
 	}
 
 Here's the hitch - the caller has no way of distinguishing "a normal
 command which resides in the first directory in the path" from "a
 normal command which contains slashes". It tries to construct a full
 command name by calling padvance() entry->u.index times:
 
 		case CMDNORMAL: {
 			int j = entry.u.index;
 			char *path = pathval(), *name;
 			do { 
 				name = padvance(&path, argv[i]);
 				stunalloc(name);
 				out1fmt("%s\n", name);
 			} while (--j >= 0);
 			out1fmt(" is%s %s\n",
 			    cmdp ? " a tracked alias for" : "", name);
 			break;
 		}
 
 This seems to me an extremely awkward way of concatenating two
 strings... but never mind.
 
 To summarize, there are (at least) two bugs in the way find_command()
 treats command names with slashes in them:
 
  * it sets entry->u.index to 0, thus telling the caller that the
    command is in the first directory in the path
 
  * it does not check that the command actually exists and is
    executable by the current user, which results in the following:
 
 des@des ~% sh -c 'type this/file/does/not/exist'
 this/file/does/not/exist is /usr/home/des/bin/this/file/does/not/exist
 
 It is my humble opinion that the root of this problem lies with the
 use of padvance(), which is a horrible hackery. I would modify
 padvance() to take a numeric argument indicating which path component
 to use, rather than have it modify the path pointer, and to interpret
 -1 to mean "do not prepend anything at all". I would also modify it so
 it does not use a global variable (pathopt).
 
 DES
 -- 
 Dag-Erling Smorgrav - des@flood.ping.uio.no
 
Responsible-Changed-From-To: freebsd-bugs->cracauer 
Responsible-Changed-By: kris 
Responsible-Changed-When: Fri May 25 03:24:32 PDT 2001 
Responsible-Changed-Why:  
Martin maintains /bin/sh 

http://www.FreeBSD.org/cgi/query-pr.cgi?pr=12052 
State-Changed-From-To: analyzed->closed 
State-Changed-By: kris 
State-Changed-When: Sat May 26 16:21:00 PDT 2001 
State-Changed-Why:  
Martin says the bug is fixed 

http://www.FreeBSD.org/cgi/query-pr.cgi?pr=12052 
>Unformatted:
