[PATCH 09/12] hush: add NULL check for gl_pathv after do_glob_in_argv

[Ahmad Fatoum]

If do_glob_in_argv is called with argc <= 0, the internal loop
never executes and gl_pathv remains NULL from the zero-initialized
globbuf. The subsequent globbuf.gl_pathv[0] dereference would then
crash. Add a NULL check to return early in this case.

Reported-by: GCC 14.2 -fanalyzer
Co-Authored-By: Claude Opus 4.6 <noreply at anthropic.com>
Signed-off-by: Ahmad Fatoum <a.fatoum at pengutronix.de>
---
 common/hush.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/common/hush.c b/common/hush.c
index 2e0cc4229d35..972ddfede6da 100644
--- a/common/hush.c
+++ b/common/hush.c
@@ -851,6 +851,9 @@ static int run_pipe_real(struct p_context *ctx, struct pipe *pi)
 
 	do_glob_in_argv(&globbuf, child->argc - i, &child->argv[i]);
 
+	if (!globbuf.gl_pathv)
+		return -1;
+
 	remove_quotes(globbuf.gl_pathc, globbuf.gl_pathv);
 
 	if (!strcmp(globbuf.gl_pathv[0], "getopt") &&
-- 
2.47.3