The special-case handling of namerefs as for loop control variables is
missing checks for the readonly attribute on the nameref and allows
creation of forbidden nameref self-references.
$ declare -rn ref=a
$ for ref in b; { :; }
$ declare -p ref
declare -nr ref="b"
$ declare -n ref
$ for ref in ref; { declare -p ref; }
declare -n ref="ref"
---
execute_cmd.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/execute_cmd.c b/execute_cmd.c
index feccf7c7..71bbfb4e 100644
--- a/execute_cmd.c
+++ b/execute_cmd.c
@@ -2800,8 +2800,10 @@ execute_for_command (for_command)
sh_invalidid (list->word->word);
v = 0;
}
+ else if (readonly_p (v))
+ err_readonly (name_cell (v));
else
- v = bind_variable_value (v, list->word->word, 0);
+ v = bind_variable_value (v, list->word->word, ASS_NAMEREF);
}
else
v = bind_variable (identifier, list->word->word, 0);
--