From: Jeremy Harris <jgh146exb@wizmail.org>
Date: Sat, 3 Dec 2022 23:13:53 +0000 (+0000)
Subject: Fix ${run } arg parsing
X-Git-Tag: exim-4.97-RC0~187
X-Git-Url: https://git.exim.org/exim.git/commitdiff_plain/44b6e099b76f403a55e77650821f8a69e9d2682e

Fix ${run } arg parsing

Broken-by: cfe6acff2ddc
---

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 5f2cff6f5..5ac91dc99 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -62,6 +62,10 @@ JH/14 Bug 2933: Fix regex substring match variables for null matches. Since 4.96
       occurrences) could cause a segfault if the corresponding $<n> was
       expanded.
 
+JH/15 Fix argument parsing for ${run } expansion. Previously, when an argument
+      included a close-brace character (eg. it itself used an expansion) an
+      error occurred.
+
 
 Exim version 4.96
 -----------------
diff --git a/src/src/expand.c b/src/src/expand.c
index 57ad76f77..7bb2e4274 100644
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -5614,7 +5614,7 @@ while (*s)
       const uschar * arg, ** argv;
       BOOL late_expand = TRUE;
 
-      if ((expand_forbid & RDO_RUN) != 0)
+      if (expand_forbid & RDO_RUN)
         {
         expand_string_message = US"running a command is not permitted";
         goto EXPAND_FAILED;
@@ -5645,13 +5645,20 @@ while (*s)
       s++;
 
       if (late_expand)		/* this is the default case */
-	{						/*{*/
-	int n = Ustrcspn(s, "}");
+	{
+	int n;
+	const uschar * t;
+	/* Locate the end of the args */
+	(void) expand_string_internal(s,
+	  ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | ESI_SKIPPING, &t, NULL, NULL);
+	n = t - s;
 	arg = flags & ESI_SKIPPING ? NULL : string_copyn(s, n);
 	s += n;
 	}
       else
 	{
+	DEBUG(D_expand)
+	  debug_printf_indent("args string for ${run} expand before split\n");
 	if (!(arg = expand_string_internal(s,
 		ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | flags, &s, &resetok, NULL)))
 	  goto EXPAND_FAILED;
diff --git a/src/src/transport.c b/src/src/transport.c
index d04ea516a..d6cedf911 100644
--- a/src/src/transport.c
+++ b/src/src/transport.c
@@ -2190,6 +2190,8 @@ if (expand_arguments)
 
   for (int i = 0; argv[i]; i++)
     {
+    DEBUG(D_expand) debug_printf_indent("arg %d\n", i);
+
     /* Handle special fudge for passing an address list */
 
     if (addr &&
@@ -2364,7 +2366,7 @@ if (expand_arguments)
         return FALSE;
         }
 
-      if ( f.running_in_test_harness && is_tainted(expanded_arg)
+      if (  f.running_in_test_harness && is_tainted(expanded_arg)
 	 && Ustrcmp(etext, "queryprogram router") == 0)
 	{			/* hack, would be good to not need it */
 	DEBUG(D_transport)
diff --git a/test/scripts/0000-Basic/0002 b/test/scripts/0000-Basic/0002
index 1efcb2adc..5ddc9b678 100644
--- a/test/scripts/0000-Basic/0002
+++ b/test/scripts/0000-Basic/0002
@@ -808,6 +808,8 @@ ${if eq{1}{2}{${run{/non/exist}}}{1!=2}}
 rc=$runrc
 ${run,preexpand {DIR/aux-fixed/0002.runfile 0}}
 rc=$runrc
+${run{DIR/aux-fixed/0002.runfile ${quote:1}}{$value}{2}}
+rc=$runrc
 
 # PRVS
 
diff --git a/test/stdout/0002 b/test/stdout/0002
index 835d00528..d7e76e6c4 100644
--- a/test/stdout/0002
+++ b/test/stdout/0002
@@ -783,6 +783,8 @@ xyz
 1234
 
 > rc=0
+> 2
+> rc=1
 > 
 > # PRVS
 >