Access unknown address when sorting a null queue

Author: YuShuanHsieh

qtest.c

@@ -466,8 +466,8 @@ static bool do_size(int argc, char *argv[])
 
 bool do_sort(int argc, char *argv[])
 {
-    if (argc != 1) {
-        report(1, "%s takes no arguments", argv[0]);
+    if (argc != 1 && argc != 2) {
+        report(1, "%s takes 0-1 arguments", argv[0]);
         return false;
     }
 
@@ -485,6 +485,8 @@ bool do_sort(int argc, char *argv[])
     exception_cancel();
     set_noallocate_mode(false);
 
+    if (argc == 2)
+        return true;
     list_ele_t *e = q->head;
     bool ok = true;
     while (ok && e && --cnt) {

traces/trace-07-robust.cmd

@@ -7,4 +7,4 @@ it dolphin
 rh
 reverse
 size
-sort
+sort NULL