diff options
Diffstat (limited to 'patches/source/bash/patches/bash31-023')
| -rw-r--r-- | patches/source/bash/patches/bash31-023 | 125 |
1 files changed, 125 insertions, 0 deletions
diff --git a/patches/source/bash/patches/bash31-023 b/patches/source/bash/patches/bash31-023 new file mode 100644 index 000000000..4dbbf78b7 --- /dev/null +++ b/patches/source/bash/patches/bash31-023 @@ -0,0 +1,125 @@ + BASH PATCH REPORT + ================= + +Bash-Release: 3.1 +Patch-ID: bash31-023 + +Bug-Reported-by: Michal Zalewski <lcamtuf@coredump.cx> +Bug-Reference-ID: +Bug-Reference-URL: + +Bug-Description: + +A combination of nested command substitutions and function importing from +the environment can cause bash to execute code appearing in the environment +variable value following the function definition. + +Patch: + +*** ../bash-3.1.22/builtins/evalstring.c 2014-09-16 22:00:02.000000000 -0400 +--- builtins/evalstring.c 2014-10-04 16:10:47.000000000 -0400 +*************** +*** 44,47 **** +--- 44,48 ---- + #include "../redir.h" + #include "../trap.h" ++ #include "../bashintl.h" + + #if defined (HISTORY) +*************** +*** 224,233 **** + struct fd_bitmap *bitmap; + +! if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def) + { +! internal_warning ("%s: ignoring function definition attempt", from_file); +! should_jump_to_top_level = 0; +! last_result = last_command_exit_value = EX_BADUSAGE; +! break; + } + +--- 225,247 ---- + struct fd_bitmap *bitmap; + +! if (flags & SEVAL_FUNCDEF) + { +! char *x; +! +! /* If the command parses to something other than a straight +! function definition, or if we have not consumed the entire +! string, or if the parser has transformed the function +! name (as parsing will if it begins or ends with shell +! whitespace, for example), reject the attempt */ +! if (command->type != cm_function_def || +! ((x = parser_remaining_input ()) && *x) || +! (STREQ (from_file, command->value.Function_def->name->word) == 0)) +! { +! internal_warning (_("%s: ignoring function definition attempt"), from_file); +! should_jump_to_top_level = 0; +! last_result = last_command_exit_value = EX_BADUSAGE; +! reset_parser (); +! break; +! } + } + +*************** +*** 289,293 **** + + if (flags & SEVAL_ONECMD) +! break; + } + } +--- 303,310 ---- + + if (flags & SEVAL_ONECMD) +! { +! reset_parser (); +! break; +! } + } + } +*** ../bash-3.1.22/parse.y 2014-09-30 19:49:41.000000000 -0400 +--- parse.y 2014-10-04 16:10:47.000000000 -0400 +*************** +*** 2122,2125 **** +--- 2122,2135 ---- + } + ++ char * ++ parser_remaining_input () ++ { ++ if (shell_input_line == 0) ++ return 0; ++ if (shell_input_line_index < 0 || shell_input_line_index >= shell_input_line_len) ++ return '\0'; /* XXX */ ++ return (shell_input_line + shell_input_line_index); ++ } ++ + #ifdef INCLUDE_UNUSED + /* Back the input pointer up by one, effectively `ungetting' a character. */ +*** ../bash-3.1.22/shell.h 2003-06-01 15:04:36.000000000 -0400 +--- shell.h 2014-10-04 16:10:47.000000000 -0400 +*************** +*** 160,163 **** +--- 160,165 ---- + + /* Let's try declaring these here. */ ++ extern char *parser_remaining_input __P((void)); ++ + extern sh_parser_state_t *save_parser_state __P((sh_parser_state_t *)); + extern void restore_parser_state __P((sh_parser_state_t *)); +*** ../bash-3.1/patchlevel.h Wed Jul 20 13:58:20 2005 +--- patchlevel.h Wed Dec 7 13:48:42 2005 +*************** +*** 26,30 **** + looks for to find the patch level (for the sccs version string). */ + +! #define PATCHLEVEL 22 + + #endif /* _PATCHLEVEL_H_ */ +--- 26,30 ---- + looks for to find the patch level (for the sccs version string). */ + +! #define PATCHLEVEL 23 + + #endif /* _PATCHLEVEL_H_ */ |